Using SINCE in NRQL is showing an error

I’m trying to use SINCE inside NRQL (when adding new condition to a policy)
But i’m getting the following error
Invalid clauses in alert conditions: SINCE

Hi, @ido.y: Yes, NRQL alert conditions do not support SINCE or UNTIL. You specify the time window as part of the condition definition, rather than in the query itself:

It is not possible to change the time period displayed on the preview chart.

1 Like

Hi, is there a road map created for including SINCE or UNTIL in the NRQL query for alerting?
Because I want to set up alert for my custom metric if the value is less than 1 in the last 1 day OR is this already possible by another way? Please advice.

Hi there @ratheesh.nair, and welcome to the Explorers Hub. There is a Feature Idea related to this:

It appears the team does intend to sort this out, but I can’t say when that might happen. Until then, I would encourage you to add your vote to the topic and share any use case details that are important to you there!

Hi,

I want to create an alert using NRQL if a specific transaction is not happening in the last 24 hours, it will be great that NR support “since” in the query or at least a way to define a bigger time than the current max (2h).

Regards,

Rigre

2 Likes

Hi @rigre.sonora, you’re right this would be a great feature. It would be worth adding your vote and comment your use-case in the Feature Idea too to help support this :smiley:

Hi @rigre.sonora,

I just wanted to jump in here to clarify some things.

First of all, the SINCE clause is implied, and is determined by your Evaluation offset settings. The default setting is 3 minutes and results in an implicit SINCE 3 minutes ago UNTIL 2 minutes ago clause. You can learn more about the evaluation offset setting in the official documentation and in this article about data latency and how it affects NRQL alert conditions. To be clear: the SINCE clause has no bearing on the threshold duration.

As @philweber already mentioned, the time period shown on the preview graph is not configurable, and a SINCE clause would not change that.

Currently, the alerts evaluation system looks at each minute individually, and in some cases builds a model for itself over the course of some time period (no more than 2 hours). From what you’ve been saying, it sounds like a 1-minute timeslice would work fine.

What it sounds like you’re asking for is a threshold duration of 24 hours. You mentioned that

I want to set up alert for my custom metric if the value is less than 1 in the last 1 day

There is one way you can at least open a violation in this case, but it depends whether you mean if the value is less than 1 for the entire last day or if the value is less than 1 at least once in the last 24 hours. If you want the at least once in version, you can use a threshold like Query returns a value less than 1 at least once in 2 hours. This will not be exactly the same, but will open a violation the first time that value drops below 1 and not close the violation until 2 hours pass with the violation staying at 1 or above.

If you want the “for the entire last day” version, then you’re asking for increased threshold duration, and I recommend you suggest that in the Feature Ideas section of the Explorers Hub as it is not something that is currently available. The Alerts Feature Ideas section can be found at this link.

I hope this helps!