The new subquery feature in Prometheus 2.7 makes this possible in one query.

Let's say you wanted to know how much of the time in the last hour you were receiving over 1Mb/s, based on the average usage in the last five minutes. You can get the average usage over the last 5 minutes in bits/second with:

rate(node_network_receive_bytes_total[5m]) * 8

You can change this into a 0 or 1 depending on whether it's above or below a value using the bool modifier:

rate(node_network_receive_bytes_total[5m]) * 8 > bool 1000000

Previously you would have had to create a recording rule to go to the next step, however subqueries allow you to do it on the fly:

(rate(node_network_receive_bytes_total[5m]) * 8 > bool 1000000)[1h:]

This says to calculate the given expression as a range vector over the past hour, using the default (i.e. global) evaluation interval. From there it's a standard avg_over_time :

avg_over_time((rate(node_network_receive_bytes_total[5m]) * 8 > bool 1000000)[1h:])

This is handy for ad-hoc usage, however if this is going to be used regularly by a rule it'd be best to use recording rules rather than subqueries. This is to avoid re-computing the entire hour worth of subquery output at every evaluation interval.

Have PromQL questions? Contact us.