Documentation Grafana Cloud AI and machine learning Grafana Assistant Data analysis Run a systematic investigation

Run a systematic investigation

Use this guide when ad-hoc questions reveal a broader incident and you want specialized agents to keep working in the background. The steps show you how to launch, monitor, and wrap up an investigation directly from the Assistant.

What you’ll achieve

• Capture the current incident context and convert it into an investigation prompt.
• Monitor multiple specialist agents as they gather data across metrics, logs, traces, and profiles.
• Review the resulting report and pull actionable next steps back into your response plan.

Before you begin

• Investigations entitlement: Enable Grafana Assistant Investigations for your organization.
• Clear problem statement: Summarize the symptom, timeframe, and suspected components.
• Context items: Optional dashboards, panels, or runbooks to attach via @ mentions.

Decide whether to launch an investigation

Evaluate whether the situation needs background agents or can stay in chat so you apply the right level of automation.

Stay in chat when you only need a handful of follow-up queries. Launch an investigation when:

• The issue spans multiple data sources or services.
• You need agents to work in parallel while you continue triaging.
• You want a structured report with to-dos, insights, and a timeline.

Launch the investigation

Kick off the specialized workflow by switching to Investigation mode and supplying a detailed prompt the agents can act on.

1. Open the Assistant sidebar and switch the input mode to Investigation, or select Launch investigation from the utility menu.
2. Provide a detailed prompt that covers symptom, impact, and focus areas. Mention specific services or labels with @ and, if helpful, reference example dashboards or alerts:

Copy

The shopping cart is slow. Investigate latency spikes after 17:30. Focus on @catalogservice and the panels that use the app=shopping-cart label.

3. Confirm that the investigation starts. The Assistant posts a status card with a link to the investigation workspace.

Monitor agent progress

Track which agents are running and guide them with feedback so the investigation stays aligned to your goals.

• Watch the activity feed in the investigation workspace to see which agents are running.
• Review the in-chat updates for high-level findings while you continue the incident response.
• Use thumbs-up or thumbs-down feedback, and short clarifying prompts, to steer agent behavior. The agents adjust queries and priorities based on your signals.

Review the investigation report

Walk through each section of the report to understand findings, timelines, and outstanding actions.

Open the Summary, Report, Timeline, and Activity sections to capture the outcome:

• Summary: High-level explanation and recommended actions.
• Report: Detailed write-up with query results and supporting context.
• Timeline: Sequence of agent tasks so you can audit the investigation path.
• Activity: Raw events, useful when you need to reproduce steps.

Ask the Assistant to highlight the most critical findings or to translate them into incident updates:

Copy

Summarize the top three insights from the investigation for the incident channel.

Follow up on the findings

Translate the investigation results into concrete actions and clean up the workspace once the response moves forward.

• Convert investigation to-dos into work items in your incident tool.
• Ask the Assistant to generate dashboards or alerts based on the findings.
• Close or archive the investigation once you confirm the resolution to keep the investigation workspace tidy.
• Start a new conversation when you move on to unrelated work so follow-up prompts do not pull in the earlier incident context.

Capture the investigation outcome

At the end of this workflow you have an investigation workspace with documented findings, links, and to-dos. You also have a chat transcript that records the launch prompt and any guidance you provided, which you can attach to your incident timeline.

Troubleshooting

• Investigation stuck in pending: check investigation status in Settings > Behavior or relaunch with a simplified prompt.
• Missing data source access: confirm the agents can query the same data sources you use in Grafana Explore.
• No useful findings: guide the agents with additional context, for example, Ignore NGINX logs and focus on application metrics. Offer concrete examples, such as recent errors, affected endpoints, or timestamps, to tighten the scope.

Next steps

• Learn Correlate multiple signals to combine different data types in one view.
• Build monitoring dashboards with Dashboard management based on investigation findings.