# Query validation

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fslos%2Fcreate%2Fquery-validation.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fslos%2Fcreate%2Fquery-validation.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

When you create an SLO, the system automatically runs built-in validations. These surface in the **Preview** panel as pass, warning, or fail statuses. Only a missing required field or a query that can't parse or run stops you from creating the SLO. Other findings appear as warnings you can review and save through. Once the queries run, the **Preview** section displays the values, **Good events** and **Total events** for Event-based SLOs, or **Metric** and **Status** for Time window-based SLOs.

| Validation type                               | Description                                                                                                                                                                   | Troubleshooting                                                                                                                                                                                            | SLO type                       |
| --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
| **Invalid query syntax**                      | Query contains a syntax error that prevents it from running.                                                                                                                  | Check for typos, missing brackets, or invalid operators. Use autocomplete to correct issues.                                                                                                               | Event-based, Time window-based |
| **Good events exceed total events**           | Good events query returns more results than the total events query.                                                                                                           | Make sure the good events query is a subset of the total events. Check for incorrect filters or overly broad logic.                                                                                        | Event-based                    |
| **Excessive query cardinality**               | Query includes too many unique time series and exceeds system limits.                                                                                                         | Add filters or reduce grouping dimensions. If needed, split the SLO into multiple smaller ones.                                                                                                            | Event-based, Time window-based |
| **Grouping mismatch – between queries**       | Good and total events queries use different grouping fields.                                                                                                                  | Ensure both queries use the same `group_by` dimensions. Compare fields side by side to align them.                                                                                                         | Event-based                    |
| **Grouping mismatch – within the same query** | Mismatched groupings between subqueries within a single query.                                                                                                                | Ensure all subqueries use the same `group_by` dimensions.                                                                                                                                                  | Event-based, Time window-based |
| **Negative query values**                     | The query produced a negative result, which is not allowed.                                                                                                                   | Adjust the query logic to ensure the output is always non-negative.                                                                                                                                        | Event-based, Time window-based |
| **Missing a required time-window function**   | This query is missing a required time-window function.                                                                                                                        | SLO queries must include a time-based operator (for example, `increase()`, `rate()`, `sum_over_time()`). Use `increase()` or `rate()` for counters, and `sum_over_time()` or `avg_over_time()` for gauges. | Event-based, Time window-based |
| **Query is missing aggregation**              | The query does not include an aggregation function.                                                                                                                           | Add an aggregation function (for example, `sum` or `avg`).                                                                                                                                                 | Event-based, Time window-based |
| **Recording rule detected**                   | Metric is based on a recording rule.                                                                                                                                          | To ensure reliable SLO results, add a 2m [offset](https://coralogix.com/docs/user-guides/slos/recording-rule-based-metrics.md) so that the data has time to fully update.                                  | Event-based, Time window-based |
| **E2M detected**                              | The provided metric is based on an E2M.                                                                                                                                       | To ensure reliable SLO results, add a 2m [offset](https://coralogix.com/docs/user-guides/slos/recording-rule-based-metrics.md) so that the data has time to fully update.                                  | Event-based, Time window-based |
| **Internal error**                            | Failed to validate the metric. The SLO cannot be created due to an internal error.                                                                                            | Try again. If the issue persists, contact support.                                                                                                                                                         | Event-based, Time window-based |
| **SLO group limitation**                      | SLOs can include a maximum of 500 groups. If an SLO exceeds this limit, the system stops tracking it.                                                                         | Reduce the number of group-by values or add filters to exclude unnecessary groups.                                                                                                                         | Event-based, Time window-based |
| **SLO type is required**                      | When creating an SLO via through a [programmatic request](https://coralogix.com/docs/user-guides/slos/IaC.md), the `sloType` field is missing or does not match the SLI type. | Ensure the request includes the `sloType` field (`request` or `window`) and that it matches the configured SLI type.                                                                                       | Event-based, Time window-based |

## Next steps[​](#next-steps "Direct link to Next steps")

Learn how to prevent inaccurate SLO evaluations when using derived metrics in [Safe use of recording rule-based metrics and event2metrics in SLOs](https://coralogix.com/docs/user-guides/slos/recording-rule-based-metrics.md).