---
title: "Find data to alert on | Grafana Labs"
description: "Use Grafana's exploration tools to discover metrics or logs for your alert."
---

# Find data to alert on

Before creating an alert rule, you need to know the exact metric or log query you want to monitor. Grafana’s Drilldown apps make this easy—you can explore your data, find interesting metrics or logs, and then use those queries in your alert.

You don’t need an existing dashboard. The Drilldown apps let you discover what’s available and identify what’s worth alerting on.

To find data to alert on, complete the following steps:

1. Sign in to your [Grafana Cloud account](/auth/sign-in).
2. In Grafana Cloud, select **Drilldown** from the main menu.
3. Choose the appropriate Drilldown app based on what you want to alert on:
   
   Expand table
   
   | If you want to alert on                    | Select                |
   |--------------------------------------------|-----------------------|
   | Infrastructure metrics (CPU, memory, disk) | **Metrics Drilldown** |
   | Application or system logs                 | **Logs Drilldown**    |
4. In the Drilldown app, explore the available data:
   
   - For **Metrics Drilldown**: Browse metric names, filter by labels (like `job` or `instance`), and view current values.
   - For **Logs Drilldown**: Search log content, filter by labels, and identify patterns worth alerting on.
5. Identify a specific metric or log pattern you want to alert on.
   
   **Metrics examples:**
   
   Expand table
   
   | Metric                           | Use case           |
   |----------------------------------|--------------------|
   | `node_cpu_seconds_total`         | CPU usage per host |
   | `node_memory_MemAvailable_bytes` | Available memory   |
   | `node_filesystem_avail_bytes`    | Disk space         |
   
   **Logs examples:**
   
   Expand table
   
   | Log query                              | Use case             |
   |----------------------------------------|----------------------|
   | `{job="myapp"} |= "error"`             | Application errors   |
   | `{job="nginx"} | json | status >= 500` | HTTP 5xx errors      |
   | `{job="syslog"} |= "OOM"`              | Out-of-memory events |
6. Note the metric name or log query—you’ll use this in your alert rule.
   
   > **Tip:** You can also copy the query directly from the Drilldown app to paste into your alert rule later.

In the next milestone, you’ll build your alert query.

* * *

### More to explore (optional)

- [Explore metrics using Metrics Drilldown](/docs/grafana-cloud/visualizations/simplified-exploration/metrics/)
- [Explore logs using Logs Drilldown](/docs/grafana-cloud/visualizations/simplified-exploration/logs/)