# Query validation

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fslos%2Fcreate%2Fquery-validation.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fslos%2Fcreate%2Fquery-validation.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

When you create an SLO, the system automatically runs built-in validations. If a validation fails, an error message appears and you must fix the query before continuing. Once the queries are valid, the **Preview** section displays the correct values—**Good events** and **Total events** for Event-based SLOs, or **Metric** and **Status** for Time window-based SLOs.

| Validation type                               | Description                                                                                                                                                                         | Troubleshooting                                                                                                                                                                                            | SLO type                       |
| --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
| **Invalid query syntax**                      | Query contains a syntax error that prevents it from running.                                                                                                                        | Check for typos, missing brackets, or invalid operators. Use autocomplete to correct issues.                                                                                                               | Event-based, Time window-based |
| **Good events exceed total events**           | Good events query returns more results than the total events query.                                                                                                                 | Make sure the good events query is a subset of the total events. Check for incorrect filters or overly broad logic.                                                                                        | Event-based                    |
| **Excessive query cardinality**               | Query includes too many unique time series and exceeds system limits.                                                                                                               | Add filters or reduce grouping dimensions. If needed, split the SLO into multiple smaller ones.                                                                                                            | Event-based, Time window-based |
| **Grouping mismatch – between queries**       | Good and total events queries use different grouping fields.                                                                                                                        | Ensure both queries use the same `group_by` dimensions. Compare fields side by side to align them.                                                                                                         | Event-based                    |
| **Grouping mismatch – within the same query** | Mismatched groupings between subqueries within a single query.                                                                                                                      | Ensure all subqueries use the same `group_by` dimensions.                                                                                                                                                  | Event-based, Time window-based |
| **Negative query values**                     | The query produced a negative result, which is not allowed.                                                                                                                         | Adjust the query logic to ensure the output is always non-negative.                                                                                                                                        | Event-based, Time window-based |
| **Missing a required time-window function**   | This query is missing a required time-window function.                                                                                                                              | SLO queries must include a time-based operator (for example, `increase()`, `rate()`, `sum_over_time()`). Use `increase()` or `rate()` for counters, and `sum_over_time()` or `avg_over_time()` for gauges. | Event-based, Time window-based |
| **Query is missing aggregation**              | The query does not include an aggregation function.                                                                                                                                 | Add an aggregation function (for example, `sum` or `avg`).                                                                                                                                                 | Event-based, Time window-based |
| **Recording rule detected**                   | Metric is based on a recording rule.                                                                                                                                                | To ensure reliable SLO results, add a 2m [offset](https://coralogix.com/docs/docs/user-guides/slos/recording-rule-based-metrics/.md) so that the data has time to fully update.                            | Event-based, Time window-based |
| **E2M detected**                              | The provided metric is based on an E2M.                                                                                                                                             | To ensure reliable SLO results, add a 2m [offset](https://coralogix.com/docs/docs/user-guides/slos/recording-rule-based-metrics/.md) so that the data has time to fully update.                            | Event-based, Time window-based |
| **Internal error**                            | Failed to validate the metric. The SLO cannot be created due to an internal error.                                                                                                  | Try again. If the issue persists, contact support.                                                                                                                                                         | Event-based, Time window-based |
| **SLO group limitation**                      | SLOs can include a maximum of 500 groups. If an SLO exceeds this limit, the system stops tracking it.                                                                               | Reduce the number of group-by values or add filters to exclude unnecessary groups.                                                                                                                         | Event-based, Time window-based |
| **SLO type is required**                      | When creating an SLO via through a [programmatic request](https://coralogix.com/docs/docs/user-guides/slos/IaC/.md), the `sloType` field is missing or does not match the SLI type. | Ensure the request includes the `sloType` field (`request` or `window`) and that it matches the configured SLI type.                                                                                       | Event-based, Time window-based |

## Next steps[​](#next-steps "Direct link to Next steps")

Learn how to prevent inaccurate SLO evaluations when using derived metrics in [Safe use of recording rule-based metrics and event2metrics in SLOs](https://coralogix.com/docs/docs/user-guides/slos/recording-rule-based-metrics/.md).