---
title: Complex NRQL alerting
source: https://docs.newrelic.com/docs/workflow-automation/workflow-examples/advanced/nrql-alerting
---

Compare NRQL results across time windows to detect anomalies standard alerts can't catch.

**Requirements:**

-   New Relic account
-   Email destination (see [Send notifications](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/create-destinations))
-   Schedule via [CreateSchedule API](https://docs.newrelic.com/docs/workflow-automation/workflow-automation-apis/create-schedule).

**Key actions**: `newrelic.nrdb.query`, `newrelic.notification.sendEmail`

**Use case**: Use this pattern when standard alerts can't meet requirements, such as:

-   Comparing metrics across multiple time windows
-   Applying custom mathematical operations on query results
-   Triggering only when specific thresholds or patterns are detected
-   Combining data from multiple queries with conditional logic

    ```yaml
      name: Complex_Alert_Workflow
      description: 'Compares NRQL results across time windows and sends alerts when new events are detected'
      workflowInputs:
        destinationId:
          type: String
        query:
          type: String
          defaultValue: 'FROM Span SELECT count(*)'
      steps:
        - name: query1
          type: action
          action: newrelic.nrdb.query
          version: 1
          inputs:
            query: "${{ .workflowInputs.query }} SINCE 10 minutes ago UNTIL 5 minutes ago"
            accountIds:
              - 7401815
            selectors:
              - name: length
                expression: '[ .results[] | length ]'
              - name: count
                expression: '[ .results[0].count ]'
        - name: query2
          type: action
          action: newrelic.nrdb.query
          version: 1
          inputs:
            query: "${{ .workflowInputs.query }} SINCE 5 minutes ago"
            accountIds:
              - 7401815
            selectors:
              - name: length
                expression: '[ .results[] | length ]'
              - name: count
                expression: '[ .results[0].count ]'
        - name: CheckForNewEvents
          type: switch
          switch:
            - condition: >-
                ${{ (.steps.query2.outputs.count - .steps.query1.outputs.count) > 0 }}
              next: sendEmail
          next: end
        - name: sendEmail
          type: action
          action: newrelic.notification.sendEmail
          version: 1
          inputs:
            destinationId: ${{ .workflowInputs.destinationId }}
            subject: Hello there!
            message: >-
              More spans incoming!!!
              There are --- ${{ (.steps.query2.outputs.count - .steps.query1.outputs.count) }} ---
              new Spans that were ingested in the last 5 minutes
            attachments:
              - type: QUERY
                query: ${{ .workflowInputs.query }} SINCE 5 minutes ago
                format: CSV
                filename: span_count.csv
          next: end
    ```

**To schedule**, use [CreateSchedule API](https://docs.newrelic.com/docs/workflow-automation/workflow-automation-apis/create-schedule) with cron expression `*/10 * * * *` (every 10 minutes). Minimum interval is 10 minutes. See [workflow limits](https://docs.newrelic.com/docs/workflow-automation/limitations-and-faq/workflow-limits) for details.

## Related topics [#related-topics]

[Deployment rollback](https://docs.newrelic.com/docs/workflow-automation/workflow-examples/advanced/deployment-rollback)

Use NRQL in deployment workflows

[EC2 management](https://docs.newrelic.com/docs/workflow-automation/workflow-examples/advanced/ec2-management)

Combine NRQL queries with infrastructure automation

[NRQL actions](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/actions-catalog/newrelic/newrelic-nrdb)

Learn NRQL query action syntax