Custom variables for Incident Workflows

BETA

With Incident Workflows, you identify the Policy you want to be alerted on. When the policy gets violated, the violation triggers the workflow, and violation attributes are transferred into the notification creation.

Custom variables are violation-related properties you can use as part of the configuration of a workflow action. You can retrieve Information about the alert, condition, violation, and entity by using double curly brackets:: {{variable_name}}.

Use custom variables in a filter statement

To get information about the entity that violated a condition, you can use custom variables as part of the where statement of the query. For example, to get the state of the EC2 instance use:

SELECT latest(ec2State) FROM ComputeSample where provider = 'Ec2Instance' where entityName = `{{entity.name}}'

This query returns a single value (for example, stopped), as the query only uses a single field. The variable entity.name is the identifier of the entity. You can use any other entity properties in the same way.

Workflow data enrichment examples

You can use custom variables to enrich your workflow data queries in different ways:

Query for when application traffic drops

There are times when you want to know when traffic to your application drops. You can use the {{entity.name}} variable in place of your application's name.

SELECT count(*) FROM Transaction WHERE appName = '{{entity.name}}' since 10 minutes ago
Query for transaction failures

There are times when you want to know when your application transactions have failed. This query shows the latest HTTP status code responses filtered by the {{entity.name}} variable that violated your alert policy threshold.

From Transaction select latest(httpResponseCode), average(duration) where appName = '{{entity.name}}'	
Query for Kubernetes consumption overview

Use a query like this to get the number of entities and their ingest times within a Kubernetes pod. By identifying what entities have large ingest times, you can begin to address that issue and find a potential remedy.

SELECT uniqueCount(displayName), sum(nr.ingestTimeMs) from K8sServiceSample where entityName = '{{entity.name}}' since 1 hour ago.

Full variables list by category

We'll be updating this table frequently as we make updates to Applied Intelligence.

Key

Name

Display Name

alert/account_id

alert.account_id

Alert Account ID

internal

alert.*

ALL

alert/description

alert.description

Alert Description

alert/label_names

alert.labels

Alert Labels

alert/deep_link

alert.link

Alert Link

alert/message

alert.message

Alert Message

alert/policy_name

alert.name

Alert Name

alert/policy_id

alert.id

Alert Policy ID

alert/priority

alert.priority

Alert Priority

alert/state

alert.state

Alert State

internal

*

ALL

internal

aws.*

ALL

internal

condition.*

ALL

newrelic/violation/condition_name

condition.name

Condition Name

newrelic/product

condition.product

Condition Product

newrelic/evaluation/threshold

condition.threshold

Condition Threshold

newrelic/evaluation/threshold_duration_seconds

condition.threshold_duration

Condition Threshold Duration

newrelic/evaluation/threshold_occurrences

condition.threshold_occurrences

Condition Threshold Occurrences

internal

entity.*

(queries both entity.name and entity.type)

ALL

newrelic/entity/name

entity.name

Entity Name

newrelic/entity/type

entity.type

Entity Type

newrelic/violation/close_time

violation.close_time

Violation Close Time

internal

violation.*

ALL

newrelic/signal/nrql/query

condition.nrql.query

Signal NRQL Query

newrelic/violation/deep_link_url

violation.deep_link_url

Violation Deep Link URL

newrelic/violation/degradation_time

violation.degradation_time

Violation Degradation Time

newrelic/violation/event

violation.event

Violation Event Status

host/id

violation.host.id

Violation Host ID

host/name

violation.host.name

Violation Host Name

newrelic/violation/id

violation.id

Violation ID

newrelic/violation/muted

violation.muted

Violation Muted

newrelic/violation/open_time

violation.open_time

Violation Open Time

newrelic/violation/priority

violation.priority

Violation Priority

newrelic/violation/recovery_time

violation.recovery_time

Violation Recovery Time

newrelic/violation/runbook_url

violation.runbook_url

Violation Runbook URL

newrelic/violation/time_limit

violation.time_limit

Violation Time Limit

newrelic/violation/title

violation.title

Violation Title

internal

workflow.id

Workflow Id

internal

workflow.name

Workflow Name

For more help

If you need more help, check out these support and learning resources: