Grafana / Basic: sources, fields, and interpretation / Lesson 6
Variables, repeated panels, and scoped links
Design dashboard variables as query inputs with plugin-specific formatting, explicit defaults, bounded repetition, and safe navigation scope.
On this page
Lesson goals
- Distinguish variable types and interpolation.
- Review multi-value and All behavior.
- Preserve safe time and population context in links.
A variable changes the query population
A variable can hold a constant, custom choice, query-derived value, or another supported input type. Ad hoc filters and data-source variables depend on integration support and configuration. The selected value can change every dependent panel’s population, so document defaults, refresh behavior, dependencies, and allowed scope. A hidden variable is still an input rather than an authorization boundary. Query-derived choices can also be stale or empty. Test a missing option and a renamed label instead of assuming the dashboard always opens with the author’s saved selection and current backend metadata.
Interpolation belongs to the selected query language
Grafana interpolates variables using data-source and format-specific behavior. A multi-value route variable may need regex formatting for a Prometheus regex matcher, while SQL or another integration needs a different contract. The illustrative expression uses explicit regex formatting and is not executed. Formatting is not a general guarantee of SQL parameterization, tenant isolation, or authorization. Avoid raw formatting unless its consequences are understood and reviewed. Special characters, empty values, and multiple selections can change query meaning. Test the actual plugin and variable syntax rather than assuming a label that looks right produces the intended backend expression.
transit_departure_delay_seconds{route=~"${route:regex}"}
The fragment assumes a reviewed route variable and compatible plugin formatting. No variable is created and no interpolated query is sent or evaluated.
All and repetition can expand work substantially
An All selection can mean a custom value or an expansion of choices according to variable configuration. It must not silently become cross-tenant access or a broader environment selection than intended. Repeated panels and rows can multiply query and rendering work. The offline model multiplies two selected routes by three panels to show six potential panel instances, not an actual backend request count. Caching, query sharing, hidden panels, and plugin behavior can change real work. Keep the model’s assumptions explicit and avoid claiming that a dashboard with six panels always executes exactly six queries.
selected_routes = ["r1", "r2"]
panels_per_route = 3
panel_instances = len(selected_routes) * panels_per_route
print("potential_panel_instances", panel_instances)
print("backend_request_count_not_measured")
potential_panel_instances 6
backend_request_count_not_measuredThe result counts modeled panel instances only. It performs no Grafana repetition, query scheduling, rendering, or cost measurement.
Carry only the context needed for navigation
Dashboard, panel, and data links can lead from an overview to a related view or event. Preserve appropriate source, route, and time scope using supported link variables and encoding. A detail link that drops the environment can show unrelated evidence and mislead a responder. Do not put credentials, private payloads, or unnecessary personal identifiers in URLs. The destination requires its own authorization even when a link was visible. A field value is untrusted input for navigation and formatting; review allowed destinations and query meaning rather than treating every returned string as a safe link.
Test the dashboard as a set of input states
Use synthetic cases for default, single, multiple, All, empty, stale, and special-character selections. Check dependent variables, repeated layout, displayed scope, links, and query contracts together. Preserve version and plugin assumptions because syntax and capabilities evolve. This lesson runs only fixed multiplication and supplies an unexecuted query fragment. It creates no variable or link, opens no dashboard, and queries no account or source. Report the local result as a model of possible expansion, with actual interpolation, access, and rendering behavior left for an authorized isolated integration.
Common errors and fixes
A hidden variable is called tenant security
- Why it happens
- UI selection was confused with enforced authorization.
- How to fix it
- Apply access controls at the appropriate trusted boundary.
- Prevent it next time
- Test access independently from variable visibility.
A multi-value selection breaks a query
- Why it happens
- Formatting assumptions do not match the query language.
- How to fix it
- Use reviewed source-specific interpolation and escaping.
- Prevent it next time
- Test empty and special-character values.
A repeated dashboard overloads the expected view
- Why it happens
- Selection expansion and work amplification were ignored.
- How to fix it
- Bound choices and review actual authorized query cost.
- Prevent it next time
- Model panel multiplication before rollout.
Check your understanding
1. Why should the All option be tested rather than assumed equivalent to every single selection?
Show worked solution
Its configured expansion or custom value can produce different query syntax, matching, and scope. Multi-value interpolation also depends on the data-source plugin. Verify the intended population, empty behavior, access boundary, and work expansion with explicit synthetic cases before using it in a shared dashboard.
2. A detail link opens the correct route but another time range. Is that sufficient for incident diagnosis?
Show worked solution
No. Time is part of the evidence scope, so the destination may show unrelated observations. Carry supported safe time and variable context and verify destination authorization. Do not include private payloads to compensate for missing scope; use deliberate stable navigation fields and an explicit link contract.
Key takeaways
- Variables are query inputs with source-specific formatting.
- All and repetition change scope and possible work.
- Links preserve evidence context but do not grant access.