Promql practice questions

sum(node_memory_Usage_bytes) drop (instance)

Why wrong: The 'drop' keyword is not a valid PromQL aggregation modifier.

sum(node_memory_Usage_bytes) by (job)

Why wrong: The 'by' clause drops all labels except 'job', meaning the 'instance' label would be discarded.

sum(node_memory_Usage_bytes) without (instance)

Why wrong: This would drop the 'instance' label and keep everything else, which is the opposite of keeping instance while grouping by job.

rate(http_requests_total{status='200'})

Why wrong: The rate function requires a range vector argument.

http_requests_total{status='200'}[5m]

Why wrong: This returns a range vector, not an instant vector.

http_requests_total{status='200'} offset 5m

Why wrong: The offset modifier shifts the time, but the syntax is incomplete for an expression result.

process_cpu_seconds_total * ignoring(job) up

Why wrong: Ignoring is usually less precise than 'on' for filtered joins.

process_cpu_seconds_total * group_left up

Why wrong: This requires an 'on' or 'ignoring' clause to match labels.

process_cpu_seconds_total and on(instance) up

Why wrong: 'and' is a set intersection operator, not an arithmetic join.

Operators are evaluated strictly from left to right regardless of type.

Why wrong: Precedence rules take priority over left-to-right evaluation.

Operators are evaluated strictly from right to left.

Why wrong: PromQL respects standard mathematical precedence rules.

Addition has higher precedence than multiplication.

Why wrong: This would violate standard mathematical conventions.

http_requests_total{environment=~"^((?!production).)*$"}

Why wrong: While a complex regex could work, the dedicated != operator is the standard and efficient way.

http_requests_total{environment!~"production"}

Why wrong: The !~ operator is for negative regular expression matching.

http_requests_total{environment!^"production"}

Why wrong: The syntax !^ does not exist in PromQL.

sum(node_cpu_seconds_total) keeping (instance)

Why wrong: The keeping keyword is not valid syntax in PromQL aggregations.

sum(node_cpu_seconds_total) group by (instance)

Why wrong: The group by syntax is invalid; 'by' should immediately follow the aggregation operator.

sum without (instance) (node_cpu_seconds_total)

Why wrong: The 'without' clause removes the specified labels instead of keeping them.

group_left(...)

Why wrong: group_left is used for many-to-one or one-to-many matching, not for selecting matching label keys.

ignoring(...)

Why wrong: The 'ignoring' modifier excludes specific labels from matching consideration, keeping all others.

matching(...)

Why wrong: matching is not a valid PromQL keyword modifier.

increase(http_requests_total[5m])

Why wrong: increase returns the total absolute increase over the range window, not a per-second rate.

rate(http_requests_total[5m])

Why wrong: rate calculates the average per-second rate over the whole window, including extrapolation.

delta(http_requests_total[5m])

Why wrong: delta is intended for gauge metrics, not counters.

String

Why wrong: String vectors are not a standard query return type for metric queries.

Range vector

Why wrong: Range vectors require bracket notation specifying a time duration.

Scalar

Why wrong: Scalars are single numerical values without time series context.

rate(histogram_quantile(0.99, http_request_duration_seconds_bucket)[5m])

Why wrong: histogram_quantile returns an instant vector, which cannot be wrapped directly in a range vector for rate().

quantile_over_time(0.99, http_request_duration_seconds[5m])

Why wrong: quantile_over_time operates on range vectors of gauges, not cumulative histograms.

histogram_quantile(http_request_duration_seconds_bucket[5m], 0.99)

Why wrong: The function signature expects the quantile scalar first, followed by the rate of buckets.

deriv(node_disk_bytes_used[3h])

Why wrong: deriv calculates the per-second derivative of the gauge using simple linear regression.

increase(node_disk_bytes_used[3h])

Why wrong: increase is intended for counters and automatically handles counter resets.

rate(node_disk_bytes_used[3h])

Why wrong: rate is strictly for counters and calculates a per-second average.

sum(up)

Why wrong: sum adds up the numerical values of the time series, not their quantity.

len(up)

Why wrong: len is not a valid PromQL aggregation operator.

total(up)

Why wrong: total is not a valid PromQL aggregation operator.

IS

Why wrong: IS is not a valid keyword or operator in PromQL.

:=

Why wrong: := is not a valid operator in PromQL.

==

Why wrong: == is used as a binary comparison operator between vectors or scalars, not inside label selectors.

include_labels

Why wrong: include_labels is not a valid PromQL keyword.

keep_all

Why wrong: keep_all is not a valid PromQL keyword.

group_right

Why wrong: group_right would be used if the 'one' side was on the right and you needed its labels.

It treats the negative difference as an error and returns 0 for the entire range.

Why wrong: It does not return 0 for the entire range due to a single reset.

It adds a fixed offset value configured in Prometheus global settings.

Why wrong: There is no global offset setting for counter resets in Prometheus.

It drops the samples surrounding the reset, resulting in a null value for that evaluation.

Why wrong: It does not drop samples; it actively compensates for the reset.

http_requests_total{status=@"5*"}

Why wrong: The @ modifier is used for native histogram timestamp adjustments, not matching.

http_requests_total{status=^"5"}

Why wrong: The syntax =^ is invalid in PromQL.

http_requests_total{status=~"5$"}

Why wrong: The $ anchor matches the end of the string, so 5$ would match strings ending with 5.

max(node_memory_usage_bytes[1h])

Why wrong: Aggregation operators like max cannot take range vectors directly without an over_time function.

topk(1, node_memory_usage_bytes[1h])

Why wrong: topk returns the largest elements of an instant vector, not over a range window.

max_with_range(node_memory_usage_bytes, 1h)

Why wrong: max_with_range is not a valid function name.

An instant vector includes timestamps from the future, while range vectors are strictly historical.

Why wrong: Neither vector type includes timestamps from the future.

An instant vector can only be used with counters, while range vectors can only be used with gauges.

Why wrong: Both vector types can be used with both metric types depending on the function.

A range vector evaluates faster because it caches historical calculations.

Why wrong: Range vectors require more memory and evaluation overhead due to processing multiple points.

It disables counter reset detection algorithms.

Why wrong: Counter reset detection functions independently of the window size.

PromQL automatically rejects any range window shorter than 5 minutes.

Why wrong: PromQL allows windows shorter than 5 minutes, even down to milliseconds.

It causes Prometheus to run out of memory due to high sample density.

Why wrong: Memory usage is driven by the total number of active time series, not short range windows.

A range vector spanning 5 minutes.

Why wrong: rate() converts range vectors into instant vectors.

An instant vector preserving all original metric labels.

Why wrong: Unspecified aggregation drops all distinctive labels.

A scalar value representing the exact floating-point result.

Why wrong: Aggregations return instant vectors, not raw scalars, unless explicitly coerced.