--- title: Workflow variables source: https://docs.newrelic.com/docs/alerts/get-notified/custom-variables-alert-event-workflows --- An explanation of the variables used for New Relic alerts [workflows](https://docs.newrelic.com/docs/alerts/get-notified/alert-event-workflows). ![Alerts workflow variables](https://docs.newrelic.com/images/alerts_screenshot-crop_workflow-variables.webp "Alerts workflow variables") When creating a accumulations.conditionDescriptionworkflow, you can use variables to a) govern what types of issues will generate a notification, and b) what the contents of a notification payload will contain. This screenshot shows the notification payload section. ## Variables [#variables] Here are the workflow variables and their descriptions: | Key (first word used for grouping) | Display name (first word used for grouping) | Description | | ---------------------------------------------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `accumulations.conditionDescription` | conditionDescription | A list of the custom violation descriptions. | | `accumulations.conditionFamilyId` | conditionFamilyId | List of the condition IDs. | | `accumulations.conditionName` | Alert condition names | New Relic breached condition. | | `accumulations.conditionProduct` | Alert condition products | New Relic condition type. | | `accumulations.deepLinkUrl` | Violation Callback Url | A direct link to the relevant violation callback. | | `accumulations.evaluation.metricValueFunction` | Custom metric value function | Custom metric value function. | | `accumulations.evaluation.name` | APM condition metric name | APM condition metric name | | `accumulations.nrqlQuery` | NRQL query | NRQL query of the condition. | | `accumulations.origins` | Issue origins | New Relic or third party source(s) that created the alert event(s). | | `accumulations.policyName` | Alert policy names | List of the policy names. | | `accumulations.runbookUrl` | Runbook URL | A list of runbook URLs. | | `accumulations.sources` | Issue sources | The system(s) reporting the alert event(s). | | `accumulations.tag.account` | New Relic accounts | New Relic accounts. | | `accumulations.tag.affectedService` | Affected service | A list of affected services. | | `accumulations.tag.assignmentGroup` | Assignment group | A list of assignment groups. | | `accumulations.tag.causeService` | Cause service | A list of the cause services. | | `acknowledgedBy` | Acknowledged by | The user that acknowledged the issue. | | `activatedAt` | Issue activated at | Timestamp of issue activation. | | `annotations.description` | Issue description | List of Issues' descriptions. | | `annotations.title` | Issue title | List of issues' titles. | | `annotations.wildcard` | Alert facets | Alert facets. | | `closedBy` | Closed by | The ID of the user that closed the issue. | | `closedAt` | Issue ClosedAt | Timestamp of issue closure. Null if the issue is not closed. | | `closedIncidentsCount` | Closed alert events count | The total number of closed alert events on this issue. | | `createdAt` | Issue CreatedAt | Timestamp of issue creation. | | `dataMLModules.components` | Machine learning components | A list of New Relic alerts machine learning components. | | `dataMLModules.goldenSignals` | Machine learning golden signals | A list of New Relic alerts machine learning golden signals. | | `dataMLModules.suggestedResponders` | Machine learning suggested responder | (Deprecated) A list of New Relic alerts machine learning suggested responders. | | `entitiesData.entities` | Impacted entities data | A list of objects describing the impacted entity name, ID, type, and kind. | | `entitiesData.ids` | Impacted entities IDs | A set of all impacted entity IDs. | | `entitiesData.kinds` | Impacted entities kinds | A set of all impacted entity kinds. | | `entitiesData.names` | Impacted entities names | A set of all impacted entity names. | | `entitiesData.types` | Impacted entities types | A set of all impacted entity types. | | `impactedEntitiesCount` | Impacted entities count | The number of impacted entities for this issue. | | `incidentIds` | Incident IDs | A list of all the issue's aggregated alert events. | | `isCorrelated` | Issue is correlated | If the issue is correlated (`true`, `false`). | | `isAcknowledged` | Issue is acknowledged | If the issue is acknowledged (`true`, `false`). | | `issueAckUrl` | Issue acknowledge URL | A direct link to acknowledge the issue. | | `issueCloseUrl` | Issue close URL | A direct link to close the issue. | | `issuePageUrl` | Issue page URL | A direct link to the relevant issue page. | | `issueActivatedAtUtc` | Issue ActivatedAt UTC string | String format of issue activation in UTC. | | `issueClosedAtUtc` | Issue ClosedAt UTC string | String format of issue closure in UTC. | | `issueCreatedAtUtc` | Issue CreatedAt UTC string | String format of issue creation in UTC. | | `issueAcknowledgedAt` | Issue AcknowledgedAt string | String format of issue acknowledged in UTC. | | `issueClosedAt` | Issue ClosedAt string | String format of issue closure in UTC. | | `issueDurationMs` | Issue duration in milliseconds | The number of milliseconds since the issue opened. | | `issueDurationText` | Textual issue duration | A human friendly representation of the issue duration. | | `issueId` | Issue ID | The unique ID of the issue. | | `issueTitle` | Issue title | The title of the issue, usually the title of the first alert event. | | `issueUpdatedAt` | Issue UpdatedAt UTC string | Timestamp of issue update in UTC. | | `labels.accountIds` | Issue environment associated account ID | New Relic alerts environments associated account ID. | | `labels.aggregationKeys` | Labels alerts aggregation key | New Relic alert event detection original incident ID. | | `labels.originalAccountIds` | Labels account IDs | Alert event detection policy's account ID. | | `labels.policyIds` | Labels alert policy IDs | Alert Event detection policy ID that generated the violation. | | `abels.targetId` | Target ID | Target ID. | | `mutingState` | Issue muting state | The calculated muting state of the issue (`MUTED`, `NOT_MUTED`). | | `nrAccountId` | Account ID | Account ID. | | `openIncidentsCount` | Open alert events count | The total number of open alert events on this issue. | | `owner` | Owner | The person that acknowledged the issue. | | `policyUrl` | Alert policy URL | Alert policy URL. | | `priority` | Issue priority | Issue's priority level (`CRITICAL`, `HIGH`, `MEDIUM`, `LOW`). | | `priorityText` | Issue priority text | Issue priority in lower case (`Critical`, `High`, `Medium`, `Low`). | | `realIssueCount` | Issue count | Issue count. | | `state` | Issue state | Issue's life cycle state (`CREATED`, `ACTIVATED`, `CLOSED`). | | `stateText` | Issue state text | Issue's life cycle state in lower case (`active` (opened), `closed`). | | `status` | Issue correlation status | The correlation status of the issue. | | `totalIncidents` | Alert event count | The number of alert events that are aggregated or correlated in the issue. | | `triggeredAt` | Issue triggered at | Timestamp of issue notification triggered. | | `triggerEvent` | Issue notification trigger event | The notification trigger event (`STATE_CHANGE`, `INCIDENT_ADDED`, `INCIDENT_CLOSED`, `CLOSE_INACTIVE`, `CLOSE_TTL`, `USER_ACTION`, `PRIORITY_CHANGED`, `MERGE_REQUEST`). | | `updatedAt` | Issue updated at | Timestamp of issue last updated. | | `violationChartUrl` | Violation Chart URL | Link to the violation chart image. | | `workflowName` | Workflow name | The name of the workflow that was triggered. | ## Workflow data enrichment examples [#enrichment-examples] To get information about the entity that breached a condition, you can use custom variables as part of the `WHERE` statement of the query. For example, to get the state of the EC2 instance use: ```sql SELECT latest(ec2State) FROM ComputeSample WHERE provider = 'Ec2Instance' AND entityName IN {{entitiesData.names}} ``` This query returns a single value (for example, `stopped`), as the query only uses a single field. The variable `entitiesData.names` is a list of identifiers for the entities. You can use any other entity properties in the same way. You can use custom variables to enrich your workflow data queries in different ways: **Query for when application traffic drops** There are times when you want to know when traffic to your application drops. You can use the `{{entitiesData.names}}` variable in place of your application's name. ````sql SELECT count(*) FROM Transaction WHERE appName IN {{entitiesData.names}} SINCE 10 minutes ago ``` ```` **Non-web transactions time** Average time the impacted entities spend processing requests/transactions, broken down by process type ````sql SELECT average(apm.service.overview.other) * 1000 FROM Metric WHERE appName IN {{entitiesData.names}} FACET `segmentName` TIMESERIES ``` ```` **Throughput** Number of requests per minute the impacted enitities process ````sql SELECT rate(count(apm.service.transaction.duration), 1 minute) AS 'Non-web throughput' FROM Metric WHERE (appName IN {{entitiesData.names}}) AND (transactionType = 'Other') TIMESERIES ``` ```` **Error rate** Ratio of errors to the total number of requests processes by the impacted entities ````sql SELECT count(apm.service.error.count) / count(apm.service.transaction.duration) AS 'Non-web errors' FROM Metric WHERE (appName IN {{entitiesData.names}}) AND (transactionType = 'Other') TIMESERIES ``` ```` **Query for transaction failures** There are times when you want to know when your application transactions have failed. This query shows the latest HTTP status code responses filtered by the `{{entitiesData.names}}` variable that breached your alert policy threshold. ````sql SELECT latest(http.statusCode), average(duration) FROM Transaction WHERE appName IN {{entitiesData.names}} ``` ```` **Query for Kubernetes consumption overview** Use a query like this to get the number of entities and their ingest times within a Kubernetes pod. By identifying what entities have large ingest times, you can begin to address that issue and find a potential remedy. ````sql SELECT uniqueCount(displayName), sum(nr.ingestTimeMs) FROM K8sServiceSample WHERE entityName IN {{entitiesData.names}} SINCE 1 hour ago ``` ```` **Query using triggering facet value** If the alert conditions query is faceted, you can use the `FACET` value triggering the alert event in a query. For example, if the alert condition is this: ````sql SELECT average(duration) FROM BrowserInteraction FACET appName ``` You can then query using the specific `appName` like this: ```sql SELECT uniques(host) FROM Transaction WHERE appName IN {{accumulations.tag.appName}} ``` ````