window_without_aggregation

Summary

window requires an aggregator

Help

wrap the selector in an aggregator before the [window], e.g. avg(cpu.usage)[5m], p95(http.latency)[1m], or rate(net.rx)[5m]

Details

When this fires

You attached a [window] to a bare selector, like cpu.usage[5m]. The engine has no way to collapse the buffered samples down to one number unless you tell it which aggregator to use.

This is a syntax-level rejection. The window itself is fine; what's missing is the aggregator wrapped around the selector.

What to check

Wrap the selector in an aggregator: avg, sum, max, min (gauges), p50/p90/p95/p99 (latency), rate (per-second slopes), delta (absolute change), stddev (spread). If you only want the latest sample, drop the [window] entirely, since bare selectors already read the most recent value.

# broken
expr = "cpu.usage[5m] > 80"
# fixed (pick the one that fits)
expr = "avg(cpu.usage)[5m] > 80"
expr = "max(cpu.usage)[5m] > 95"
expr = "p95(http.latency)[1m] > 500ms"
expr = "rate(net.rx)[5m] > 1000000"

Caught by nanook check. See @/docs/nanook-expr.md for the full aggregator list.