CCNA Promql Questions

Binary operators match series by their full label sets. When A and B share no identical label combination, no pairing exists, so the vector matching yields nothing and the expression returns an empty result rather than an error.

irate() computes a per-second rate from only the last two samples in the range, making it responsive to sudden spikes and suitable for volatile counter metrics. This satisfies the scenario's requirement to calculate rates or increases from counters, unlike functions needing longer windows.

The `=` matcher filters time series where the label value equals the given string exactly, including case sensitivity. This satisfies the stem's requirement for a correct label matcher statement, as PromQL's equality operator performs full-string comparison rather than substring or regex matching.

A one-minute range spans only a few samples at typical 15–60 second scrape intervals, so PromQL's rate() extrapolation amplifies scrape jitter and produces volatile, unreliable per-second values. This directly addresses the stem's constraint: short windows relative to scrape intervals yield noisy, jitter-sensitive results unsuitable for production alerting.

avg_over_time computes the mean of all samples within the specified range, so wrapping node_load1 in [10m] yields a rolling ten-minute average that damps short spikes. This directly satisfies the stem's requirement to smooth short-term fluctuations in a gauge.

The ignoring modifier removes the named labels from the matching signature before equality is tested. Excluding instance and region leaves job as the sole common label, so samples pair on job alone despite differing label sets, satisfying the join requirement.

An instant vector holds one sample per series at a single evaluation timestamp, whereas a range vector holds every sample within a specified lookback window for each series. This satisfies the stem's distinction, and only range vectors can feed functions such as rate() or increase().

`count` aggregates across series, yielding one output series per input group, whereas `count_values` buckets by observed sample value and emits one series per distinct value, exposing its frequency. This satisfies the stem's requirement to distinguish cardinality counting from value-frequency distribution.

label_replace() applies the supplied regex to the source label's value, and on a match writes the replacement string, with capture-group references, into the destination label. It rewrites labels for grouping or joining; it does not alter sample values or timestamps.

`unless` returns left-hand samples only where no matching right-hand series exists, filtering by label set. It satisfies the stem's requirement for a valid PromQL set operator combining instant vectors, alongside `and` and `or`. Unlike arithmetic binary operators, it operates purely on label matching rather than values.

`predict_linear` fits a least-squares linear regression over the 1h range vector and extrapolates it 4 hours ahead, satisfying the stem's demand for predictable linear extrapolation of a gauge over time. It returns the projected value of `node_filesystem_free_bytes`, exposing when the filesystem will exhaust free space.

Identical label sets on both sides give PromQL a one-to-one match by default, pairing each left-hand series with the right-hand series sharing the same labels. No on() or ignoring() clause is needed, so arithmetic between matching vectors works directly.

Native histograms expose bucket counts through a sparse, structured sample format that histogram_quantile() parses natively, so quantile estimation works without the classic le-labelled bucket series. This satisfies the stem's requirement that the function evaluate native histograms directly.

Using `on(job)` restricts matching to the `job` label, ignoring the differing `instance` label that would otherwise prevent a match. `group_left(instance)` then carries the left vector's `instance` label into the result, satisfying the requirement to retain it. This is the standard many-to-one matching configuration.

The 'on' modifier restricts matching to the label sets you explicitly name, so only series sharing those listed labels pair up. This lets vectors of differing cardinality align on a chosen subset of dimensions rather than every shared label.

The `!~` operator applies a negative regular-expression match, so `environment!~"staging"` excludes any series whose environment label matches the regex "staging", satisfying the stem's requirement for regex-based negation rather than the exact-match `!=` operator. This mirrors the positive `=~` operator but inverts the match result.

A range vector returns a set of time series, each holding multiple data points sampled over a specified time window, such as `[5m]`. This satisfies the stem's requirement for a valid PromQL data type, distinct from the instant vector's single sample per series.

An instant query evaluates at a single timestamp, so PromQL returns an instant vector holding one sample per matching series. This satisfies the stem's default behaviour, since a range vector only appears when the selector explicitly supplies a duration such as [5m].

topk is a selection, not a fixed-size generator. When fewer than three series match the selector, it simply returns every matching series, ranked by value, with no synthetic padding or error, satisfying the scenario where the selector yields fewer results than k.

predict_linear() extrapolates a gauge's rate of change, so it requires a range vector of gauge samples plus a scalar number of seconds to forecast ahead. A single instant sample gives no slope, so the range vector is the essential input for projecting disk exhaustion.

`sum` aggregates a vector's samples across matching label sets into a single instant vector, optionally grouped by labels via `by` or `without`. PromQL defines it as a core aggregation operator, so it satisfies the question's requirement for a valid operator.

`increase()` extrapolates a counter's total growth across the specified 1h window, correctly handling counter resets and returning the actual number of errors that occurred. `rate()` would instead give a per-second average, and `delta()` cannot handle resets, so neither satisfies the requirement for a total count over the last hour.

clamp_max() caps each sample's value at the given maximum, leaving lower values untouched. Applied to an instant vector, it returns the same series with values above the threshold replaced by that maximum, satisfying the requirement to bound peaks rather than filter or drop them.

A bare metric selector returns the instant vector of current samples for http_requests_total at query evaluation time, which is exactly the current value requested. No rate or aggregation function is needed for a raw counter reading.

absent() returns a non-empty result when its input vector has no samples, letting alerting rules fire on missing data. This suits detecting a metric that has stopped reporting within a given range, which is exactly the scenario described.

Multiplication binds tighter than addition in PromQL, so in `vector1 + vector2 * vector3` the `*` operation is evaluated first, then the result is added to `vector1`. PromQL follows standard arithmetic precedence, giving `*` and `/` higher precedence than `+` and `-`, satisfying the stem's precedence constraint.

The = operator performs exact string equality against a label's value, matching only samples whose label equals the given string. It is one of Prometheus's core label matching operators, alongside !=, =~ and !~, satisfying the selector requirement.

`group_left` is a many-to-one vector matching modifier, permitting each right-hand sample to pair with multiple left-hand samples while retaining left-side labels. PromQL binary vector matching requires it, alongside `on`/`ignoring` and `group_right`, to resolve cardinality mismatches between operands, satisfying the stem's request for valid matching keywords.

Prometheus rate() detects a decrease between samples and treats it as a counter reset, assuming the counter restarted at zero. It then adds the post-reset value to the pre-reset value, so the restart's lost increments are not counted as a negative rate, preserving an accurate request rate.

`sum` aggregates sample values across matching series, and both `by` and `without` modifiers are valid for it, letting you group results by specified labels or strip them from the output. This satisfies the stem's requirement for operators supporting both clause modifiers.

rate() computes the per-second average rate of increase of a counter time series across the range vector, handling counter resets automatically. This satisfies the constraint of calculating per-second average increase, unlike irate() which uses only the last two samples.

A short range vector such as [10s] samples only the last two scrape points, so irate divides the freshest delta by that tiny interval. This captures high-frequency spikes but produces volatile, noisy results, satisfying the stem's stated impact of an undersized range.

The offset modifier shifts the entire query evaluation back by the specified duration, so `http_requests_total offset 1h` returns the sample value as it existed exactly one hour before the current evaluation timestamp. This satisfies the stem's requirement for the precise time Prometheus queries when an offset is applied.

label_replace() rewrites labels on time series using a regex with capture groups, letting you add or modify a destination label from a source label. It operates within PromQL queries, satisfying the requirement for a valid PromQL label-modification method.

max_over_time evaluates the range vector over the trailing one-hour window and returns the highest sample per series, giving the peak gauge value across all instances. The [1h] duration supplies the sliding window the stem specifies.

The by (instance) modifier groups series by the instance label and sums each group's CPU counters, retaining instance while collapsing other labels such as cpu and mode. This satisfies the stem's requirement to aggregate across nodes yet keep instance.

topk(3, ...) returns the three series with the highest instantaneous values, and wrapping rate() over the 5m range converts the cumulative counter process_cpu_seconds_total into a per-second CPU usage rate, satisfying the requirement to rank jobs by CPU consumption.

The `le` pseudo-label means "less than or equal to", recording each bucket's inclusive upper bound. This satisfies the stem's constraint by exposing the cumulative count of observations falling at or below that threshold, letting you compute per-bucket counts by subtracting adjacent series.

`sum()` aggregates a metric's samples across every matched instance into a single total, satisfying the requirement to calculate the overall sum. Unlike `avg()`, which divides by sample count, or `max()`/`min()`, which select extremes, `sum()` adds each instance's contribution, yielding the combined total across all instances.

The offset modifier shifts the evaluation instant backwards by the given duration, so errors_total offset 1h returns the value from one hour ago. This satisfies the scenario's requirement to query a point in the past.

count() is the aggregation operator that returns the number of series in each group, so count(up) yields the total active series matching the selector. sum() would add sample values instead of counting series, which does not satisfy the requirement.

Scalars carry no labels, so arithmetic between a vector and scalar applies element-wise to every sample, leaving the vector's label set untouched. This satisfies the stem's requirement that dividing by `(1024 * 1024)` converts bytes to mebibytes without dropping or altering any series identity.

An instant vector holds one sample per time series at a single evaluation timestamp, unlike a range vector which holds many samples per series. This single-sample-per-series structure is the defining property that makes instant vectors suitable for instant queries and comparisons.

rate() computes the per-second average rate of increase of a counter over the given range, handling counter resets and extrapolation at the range boundaries. The 10m range selector supplies the required window, yielding a per-second figure rather than a raw increase.

The != operator is Prometheus's label matcher for inequality, so environment!="production" selects every time series of http_requests_total whose environment label holds any value other than production. This satisfies the stem's requirement to exclude production while retaining all other environments.

Delta computes the difference between a sample and its predecessor, so it requires a range vector to supply that historical window; instant vectors hold only one value per series and cannot feed it. This satisfies the stem's requirement for functions designed specifically around range vectors.

Gauge is one of Prometheus's four native metric types, representing a value that can rise or fall arbitrarily, such as temperature or memory usage. It is exposed through client libraries and stored directly in the time series database.

PromQL follows standard arithmetic precedence, so multiplication and division bind more tightly than addition and subtraction. Thus in an expression mixing * and +, the multiplication is evaluated first, matching conventional mathematical ordering rather than strict left-to-right evaluation.

stddev is a valid PromQL aggregation operator, computing the standard deviation across the grouped sample values. It accepts a by or without clause and operates over an instant vector, matching the aggregation requirement in the stem.

The =~ operator applies RE2 regular expression matching, and the anchored pattern ^5.* requires the status label value to begin with the digit 5, matching any trailing characters. This selects exactly the time series whose status starts with 5.

Rate() suits alerting on slow-moving counters because it extrapolates across the full lookback window, producing a stable per-second average even when few samples exist. Irate() uses only the last two raw samples, so sparse counters yield erratic, spiky values that trigger false alerts. This satisfies the stem's slow-moving constraint.

Prometheus evaluates the inner expression independently at each step across the 30-minute window, spaced at the 1-minute resolution, producing a range vector. This satisfies the subquery's requirement to apply an instant-vector function over time, which a plain range selector cannot do.

delta() computes the difference between the first and last sample values within a range vector, showing absolute change for a gauge over the window. It satisfies the stem's requirement for a function analysing gauge changes over time.

Subqueries bridge the gap between instant and range vectors: wrapping an instant vector expression in brackets with a range gives functions like max_over_time() the range vector input they require, which a bare instant vector cannot supply.

`max_over_time` is the correct range-vector function here: it evaluates each time series returned by `node_cpu_load` across the 30-minute window and returns the highest sample value, satisfying the "maximum over the past 30 minutes" constraint. `max()` instead aggregates across series at a single instant, not over time.

histogram_quantile() estimates the 0.99 quantile from the le bucket series, and rate() over the 5m range converts cumulative bucket counters into per-second rates. This satisfies the constraint of computing the 99th percentile latency from a histogram rather than a summary.

An instant vector selector returns one sample per matching series at the evaluation timestamp, filtered by metric name and label matchers such as job="api-server". It does not range over time or aggregate; it yields current values for the selected series.

topk is an aggregation operator that returns the k time series with the highest instantaneous values for the given metric, sorted descending. It directly satisfies the 'top 5' ranking constraint, unlike sum, avg or count, which aggregate across series rather than selecting individual ones.

Exponentiation binds tighter than multiplication and addition, so PromQL evaluates `^` first, then `*`, then `+`, matching standard mathematical precedence. This satisfies the stem's requirement to identify the highest-precedence operator among the three, since `^` outranks both `*` and `+` in every expression.

deriv() fits a linear regression over the range, treating values as ordinary numbers. When a counter resets to zero, that drop is read as a genuine negative slope, yielding large negative rates instead of the reset-corrected increase rate() provides.

Exponentiation (^) binds tighter than multiplication, division, addition and subtraction, and also tighter than comparison and logical operators, so it evaluates first in any PromQL expression. This right-associative operator sits at the top of the precedence table.

A range selector returns a range vector: every sample value with its timestamp falling inside the specified window, rather than a single instant value. Applying [5m] to a gauge therefore yields all points from the preceding five minutes.

The `on(...)` modifier restricts matching to the labels you list, so vectors with differing label sets still pair up on that shared subset. Without it, Prometheus requires identical label sets for vector-to-vector binary operations, returning no results. This directly satisfies the stem's constraint of matching on common labels only.

The `!~` operator is a valid PromQL label matcher, selecting time series whose label value does not match a given regular expression. It satisfies the stem's requirement by providing the negated regex-matching axis, complementing `=~`, `!=` and `=` as the fourth supported matcher type.

The resolution parameter sets the step interval at which the inner range-vector expression is evaluated across the subquery's window, producing a series that the outer max_over_time() then aggregates over. It is not the lookback delta nor the outer range.

Both functions return per-second rates, but the axis of difference is the sample window: rate() divides the counter increase across the whole range vector, smoothing spikes, whereas irate() uses only the final two samples, giving the instantaneous rate.