Your data. Anywhere you go.

New Relic for iOS or Android


Download on the App Store    Android App on Google play


New Relic Insights App for iOS


Download on the App Store


Learn more

Close icon

Help on a NRQL query based alert

nrql-alerting

#1

Hi,

I’d like some help on an NRQL query based alert.
I have the following query. The logic is:

  • get the latest detail_state (SUCCEEDED or FAILED)
  • raise alert if the latest event is failed
  • alert should close when the latest event is <> failed

SELECT latest(detail_state) from codepipelineevents FACET detail_pipeline WHERE detail-type = ‘CodePipeline Pipeline Execution State Change’ and detail_pipeline =‘test-pipeline’ and detail_state=‘FAILED’

I would expect the count to be 0 if the latest event is <> failed. If the latest event is failed count should be 1 and an incident raised. When the next status update comes through the query would then return 0 rows and the incident is closed.

Any ideas how I can achieve this?

Thanks


#2

Hi, @lloyd.mercer: NRQL alert conditions must return a number, so latest(detail_state) won’t work. How about:

SELECT count(*) 
FROM codepipelineevents 
WHERE detail-type = 'CodePipeline Pipeline Execution State Change' 
  AND detail_pipeline = 'test-pipeline' 
  AND detail_state = 'FAILED'

Trigger a violation when the above query returns a value greater than 0.


#3

Hi,

Thanks for the reply. I had tried the above and yes this does work and trigger the alert. I would like the alert to be closed down when a subsequent message is SUCCESS. That’s why I thought I could check the latest event only.
I’m a bit stuck as to how to achieve it, any ideas?

Thanks

Lloyd


#4

Hi, Lloyd: If the query returns a value greater than 0 (there has been at least one FAILED event), the alert condition will create a violation. If the query then returns a value of 0 failures for N minutes (whatever length of time you specify in the alert condition), the violation will automatically close.