> ## Documentation Index
> Fetch the complete documentation index at: https://docs.komodor.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Grafana Investigator
> Localises a regression across Prometheus, Loki, Tempo and Pyroscope, and returns findings that link back into Grafana.
Deploy this agent when your observability stack is Grafana and you want an incident localised across
metrics, logs, traces and profiles without pivoting between them by hand. It offers three different
ways to reach Grafana, which is the main decision to make before deploying. This page covers those
paths, what it reads, and where it stops.
## What it does
You give it an incident description and the questions you want answered. It runs the aggregate →
pivot → trace flow to localise the regression, correlating metrics against logs and traces, and
returns structured findings with Grafana deeplinks so each claim can be checked.
## What it reads
All of it read-only.
| Source | What it uses it for |
| -------------------- | -------------------------------------------------------------------------- |
| Prometheus | Rates, latencies and saturation across the incident window |
| Loki | The error text behind a failure, scoped to the failing slice |
| Tempo | Traces, and the flame graph of one bad trace |
| Pyroscope | Profiles, when the regression is in CPU or memory rather than a dependency |
| Alerts and incidents | What fired, when, and what it was watching |
| Annotations | Deploys and changes to correlate against |
| Sift | Grafana's own automated investigations, where they have already run |
## Before you deploy
| Requirement | Detail | Where to set it up |
| ----------------- | ----------------------------------------------------- | ------------------------------------------------------------------------ |
| Model access | The managed model gateway, or your own Claude API key | [Credentials & secrets](/manage-your-agents/build/credentials-secrets) |
| A path to Grafana | One of the three below | [Built-in integrations](/manage-your-agents/build/built-in-integrations) |
### Three ways to reach Grafana
| Path | How it works | Offered for |
| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------- | ----------------- |
| The agent's built-in Grafana tooling | It talks to Grafana Cloud or your own Grafana over a stored Grafana connection. Komodor is never in the data path. | Either deployment |
| Your own in-cluster server | The agent uses an MCP server you already run, which holds its own Grafana credentials. Nothing is stored in Komodor. | Self-hosted |
| The MCP Gateway | The gateway is bound to a registered remote MCP server, such as Grafana Cloud's own endpoint. | Komodor cloud |
The Grafana connection is listed as optional because the second path replaces it: a self-hosted
agent pointed at your own in-cluster server needs no connection here. Add one only to use the
agent's built-in Grafana tooling.
The wizard asks where the agent runs and then disables the paths that target does not support,
rather than hiding them — so a choice that is unavailable is visibly unavailable.
## Ask it for
In chat, or as a run's prompt:
```text theme={null}
Error rate on payments-api climbed from 0.2% to 6% starting 11:20 UTC. Localise it:
which route, which dependency, and does the profile show anything. Link the Grafana
views you used.
```
When a workflow drives it instead of a person, it takes the same structured envelope the other
investigators take — `incident_description`, `questions`, `affected_services`,
`investigation_start`, `context` and `budget_seconds`.
## Defaults and limits
| | |
| ----------- | -------------------------------------- |
| Catalog ID | `grafana-investigator` |
| Model | `claude-sonnet-4-6` |
| Time budget | 300 seconds, adjustable 60–900 per run |
| Deployment | Komodor cloud or self-hosted |
| Chat | Yes |
The time budget degrades rather than fails. At 70% the agent is nudged to converge; at 100% further
tool calls are refused and it reports what it has.
## In a workflow
This is a specialist, not a lead. An orchestrator delegates the Grafana slice of an incident to it
and synthesizes its findings with the other specialists'. Because it reads alerts as well as
telemetry, it also works as the verification step after a remediation — asking whether the signal
that fired has actually recovered.
See [Orchestration](/manage-your-agents/run/orchestration) for how a step delivers work to it.
## What it will not do
It never writes to Grafana. It cannot silence an alert, close an incident, edit a dashboard or add
an annotation.
It is bounded by retention and by what its path can reach. A self-hosted agent pointed at your own
in-cluster server sees exactly what that server exposes, and it reports an unreachable data source
rather than working around it.
## Next steps
Register a remote MCP server for the third path.
The same Grafana telemetry, combined with cluster and GPU signals.
The same investigation shape, over Datadog.
Every catalog agent, side by side.
## Related topics
- [Datadog Investigator](/manage-your-agents/build/catalog/datadog-investigator.md)
- [Cluster Investigator](/manage-your-agents/build/catalog/cluster-investigator.md)
- [Azure Investigator](/manage-your-agents/build/catalog/azure-investigator.md)
- [Agent catalog](/manage-your-agents/build/catalog/overview.md)
- [Kubernetes RCA](/manage-your-agents/build/catalog/kubernetes-rca.md)