Change InfluxDB query to include case insensitive matches in a Grafana dashboard variable

Written by Claudio Kuenzler - 2 comments

Published on June 13th 2019 - Listed in Monitoring Grafana Influx

---

For our network team I prepared a dashboard in Grafana a couple of months ago. On this dashboard they can select the wanted switch, monitored by Icinga2, and then select specific interfaces to see graphs:

The interface has to be selected from a field called NIC. Grafana retrieves this list of available interfaces with the following query:

SHOW TAG VALUES FROM $check WITH KEY = "service" WHERE "hostname" =~ /^$hostname$/ AND "service" =~ /Interface/

As you can see this query goes through the measurements table "$check", which is check_nwc_health in my case. It selects only the tag values from the selected host ($hostname) and makes sure that only services containing "Interfaces" are shown (otherwise it would also show up CPU Usage because this is also checked by check_nwc_health).

The problem? I was informed today that Grafana isn't showing the "TenGigabit" interfaces. I verified and as you can see in the screenshot above, there is indeed no TenGigabitEthernet interface listed. Why's that?

I checked in Icingaweb2 and didn't see it at first. But on the second view, finally, I saw it:

The letter I in "Interface" is a capital letter for the GigabitEthernet checks, but a small/lowercase "i" in "interface" for the ThenGigabitEthernet checks.

Until today I assumed that the regular expression in the InfluxDB query would show case insensitive matches, but obviously that's not the case. Unfortunately simply adding a /i behind the query does not do the trick. In my case I decided to solve this with optional upper and an optional lower case letter:

SHOW TAG VALUES FROM $check WITH KEY = "service" WHERE "hostname" =~ /^$hostname$/ AND "service" =~ /[I]?[i]?nterface/

All the interfaces are showing up now:

Add a comment

Show form to leave a comment

Comments (newest first)

James Beckett from wrote on Aug 12th, 2020:

*cough* what's that curly brace doing there? /(?i)interface/

---

James Beckett from wrote on Aug 12th, 2020:

Rather than explicitly multicasing each letter in the RE, you can use embedded mode switching:
... "service" =~ /(?i}interface/

---