Version vom 6. Oktober 2020, 14:21 Uhr

Troubleshooting

InfluxDB: "SHOW TAG VALUES" does not support a WHERE time clause

Issue

If you use a InfluxDB Query "SHOW TAG VALUES.." it returns all possible values instead of the one present in the time period selected.
There is a open GitHub "Feature Request": https://github.com/influxdata/influxdb/issues/5668

Workaround 1 - "Using fields" (recommended)

Using fields instead of tags. -> You have to write your "asset" data as fields.
This workaround is recommended because you can use functions like "DISTINCT" to get the unique value of a field (its like "dedup" in Splunk).

The InfluxQL looks like this:

SELECT DISTINCT("host") FROM "asset_powershell_direct" WHERE "time" > (${__from} * 1000000) - 24h AND "time" < (${__to} * 1000000)

host = is the field I want to limit by time and dedup the value
${__from} = Grafana "from" Timestamp variable (its uses the timepicker in the Grafana GUI). Because Grafana uses miliseconds and InfluxDB uses nanoseconds, you have to convert the value (* 1000000).
${__to} = Grafana "to" Timestamp variable (its uses the timepicker in the Grafana GUI). Because Grafana uses miliseconds and InfluxDB uses nanoseconds, you have to convert the value (* 1000000).
Because I want to search the data in minimum 24h back, I add "- 24h".

Workaround 2 - "Subquery"

Instead of using the following query:

SHOW TAG VALUES FROM "asset_powershell_direct" WITH KEY = "host"

use a subquery as a workaround:

SELECT "host" FROM (SELECT "<value>", "host" FROM "asset_powershell_direct" WHERE $timeFilter)

host = is the tag I want to limit by time
value = any Influx FieldKey (just needs to contain any value)
asset_powershell_direct = my example measurement-name