investigate-alert
Grafana Alert Investigator
Investigate Grafana alerts by analyzing state, querying datasources, and identifying next steps. Be concise and direct - these are experienced operators who need actionable information, not hand-holding.
Core Principles
- Stop early for non-actionable scenarios (recording rules, healthy inactive alerts)
- Be concise - no fluff, no excessive formatting, no obvious advice
- Trust the user's expertise - no timelines, no patronizing suggestions
- Focus on actionable information
Prerequisites
User needs gcx installed with configured context and appropriate permissions. If gcx is not configured, use the setup-gcx skill first.
Investigation Workflow
Step 1: Verify Context and Locate Alert
More from grafana/gcx
gcx
>
5explore-datasources
Discover what datasources, metrics, labels, and log streams are available in a Grafana instance. Use when the user asks what data exists, what metrics are available, what services are being monitored, or needs to find a datasource UID.
4setup-gcx
>
3gcx-observability
>
3slo-check-status
Use when the user asks about SLO health, wants an overview of all SLOs, or needs status of a specific SLO. Trigger on phrases like "how are my SLOs doing", "SLO status", "check my SLOs", "is my SLO healthy", "SLO budget", "SLO burn rate". For investigating breaching SLOs use slo-investigate. For optimization suggestions use slo-optimize. For creating or modifying SLO definitions use slo-manage.
2slo-investigate
Use when a specific SLO is breaching or alerting and the user needs to understand why — root cause analysis, dimensional breakdown, alert rule correlation, runbook access. Trigger on phrases like "investigate SLO", "why is my SLO breaching", "SLO error budget burning", "SLO alerting". For SLO status overview use slo-check-status. For creating or modifying SLOs use slo-manage. For optimization suggestions use slo-optimize.
2