Complex NRQL alerting

Compare NRQL results across time windows to detect anomalies standard alerts can't catch.

Requirements:

• New Relic account
• Email destination (see Send notifications)
• Schedule via CreateSchedule API.

Key actions: newrelic.nrdb.query, newrelic.notification.sendEmail

Use case: Use this pattern when standard alerts can't meet requirements, such as:

• Comparing metrics across multiple time windows

• Applying custom mathematical operations on query results

• Triggering only when specific thresholds or patterns are detected

• Combining data from multiple queries with conditional logic

  name: Complex_Alert_Workflow
    description: 'Compares NRQL results across time windows and sends alerts when new events are detected'
  
    workflowInputs:
      destinationId:
        type: String
      query:
        type: String
        defaultValue: 'FROM Span SELECT count(*)'
  
    steps:
      - name: query1
        type: action
        action: newrelic.nrdb.query
        version: 1
        inputs:
          query: "${{ .workflowInputs.query }} SINCE 10 minutes ago UNTIL 5 minutes ago"
          accountIds:
            - 7401815
          selectors:
            - name: length
              expression: '[ .results[] | length ]'
            - name: count
              expression: '[ .results[0].count ]'
  
      - name: query2
        type: action
        action: newrelic.nrdb.query
        version: 1
        inputs:
          query: "${{ .workflowInputs.query }} SINCE 5 minutes ago"
          accountIds:
            - 7401815
          selectors:
            - name: length
              expression: '[ .results[] | length ]'
            - name: count
              expression: '[ .results[0].count ]'
  
      - name: CheckForNewEvents
        type: switch
        switch:
          - condition: >-
              ${{ (.steps.query2.outputs.count - .steps.query1.outputs.count) > 0 }}
            next: sendEmail
        next: end
  
      - name: sendEmail
        type: action
        action: newrelic.notification.sendEmail
        version: 1
        inputs:
          destinationId: ${{ .workflowInputs.destinationId }}
          subject: Hello there!
          message: >-
            More spans incoming!!!
            There are --- ${{ (.steps.query2.outputs.count - .steps.query1.outputs.count) }} ---
            new Spans that were ingested in the last 5 minutes
          attachments:
            - type: QUERY
              query: ${{ .workflowInputs.query }} SINCE 5 minutes ago
              format: CSV
              filename: span_count.csv
        next: end

  Copy

To schedule, use CreateSchedule API with cron expression */10 * * * * (every 10 minutes). Minimum interval is 10 minutes. See workflow limits for details.

Related topics