# Grafana Labs

Grafana is a multi-platform, open-source analytics and interactive visualization web application that allows you to query, visualize, alert on, and explore your metrics, logs, and traces, regardless of where they are stored.

#### **In Grafana:**

![image-20250221-123621.png](https://assets.relyanceuat.xyz/images/docs/35027073446285/35027073438477.png)
1. Retrieve the following information from **Grafana Instance URL**. e.g, [https://boutique.grafana.net/](https://boutique.grafana.net/)
2. Create a **Service** **Account** using the steps mentioned in the article - [Creating Service Account](https://grafana.com/docs/grafana/latest/administration/service-accounts/#create-a-service-account-in-grafana)
3. Add a **Token** to the above Service Account using the steps mentioned in the article - [Add Token to Service Account](https://grafana.com/docs/grafana/latest/administration/service-accounts/#add-a-token-to-a-service-account-in-grafana). Store the Token in a secure location as this is used for the integration in Relyance.
4. Retrieve the **URL** and **Username** for the **Loki** (Log Service) in Grafana you want to integrate with Relaynce. This can be located from **Grafana Cloud**> **Data** **Sources** > search and click on the **Loki** service.
5. Retrieve the **URL** and **Username** for the **Tempo** (Traces Service) in Grafana you want to integrate with Relaynce. This can be located from **Grafana** **Cloud** > **Data** **Sources** > search and click on the **Tempo** service.
6. Create an **Access Policy** and **Token** using the step mentions in the article - [Create Access Policies and Tokens](https://grafana.com/docs/grafana-cloud/security-and-account-management/authentication-and-permissions/access-policies/create-access-policies/#create-access-policies-and-tokens). Store the **Access Policy Token** in a secure location as this is used for the integration in Relyance.

#### **In the Relyance AI application:**

1. Login to your Relyance account.
2. Navigate to the **Settings** menu on the bottom left-hand side.
3. Select **Integrations**.
4. Click on the **Vendor Integration** tab.
5. Find the **Grafana Labs** integration card and click it to open its connections.
6. Under **Authentication Method**, choose **Service Account**.
8. Fill in the corresponding connection fields retrieved and generated in the previous section.
9. Select the **Vendor Discovery** checkbox if you wish Relyance also to detect vendors connected to Grafana. See more information [here](/docs/introduction-to-relyance-ai/integration-features/#h_01J01Z9X7W2ZN71X9XEB3JR8KZ).
10. Select the **Enable Data Inspection** checkbox if you wish Relyance also to inspect the data. See more information [here](/docs/introduction-to-relyance-ai/integration-features/#h_01J01Z9X7W2ZN71X9XEB3JR8KZ).

The **Authentication** step asks for:

- **URL**: required.
- **Service Account Token**: required; held as a secret.
- **Loki URL (logs service)**: optional.
- **Loki Username**: optional.
- **Loopback Period (in hours)**: required.
- **Maximum Records to Sample**: required.
- **Tempo URL (traces service)**: optional.
- **Tempo Username**: optional.
- **Access Policy**: required; held as a secret.

11. Click **Authenticate**.
12. At this point, you should see Connected on the Grafana integration page and the following result on the Vendor Integrations page:
13. Congratulations, you are now connected to Grafana.

![Screenshot 2025-03-15 at 1.05.55 AM.png](https://assets.relyanceuat.xyz/images/docs/35027073446285/35027073440013.png)

<!-- failure-modes:begin (generated from the integration catalog; do not hand-edit) -->

## If the connection reports Connected but returns nothing

These are the ways this integration comes back empty without reporting an error. Generated from the integration catalog, so it tracks what the connection actually asks for.

1. **A credential rotated at the vendor is not picked up here.** **Service Account Token** and **Access Policy** are stored when you save the connection, so regenerating the value at the vendor breaks the next scan until it is re-pasted here. Recording the expiry on the connection means Relyance warns you before it lapses.
2. **Check the address fields before suspecting the credentials.** **URL**, **Loki URL (logs service)** and **Tempo URL (traces service)** identify which tenant, region or host to talk to. A wrong value there fails authentication and looks exactly like a bad secret.

<!-- failure-modes:end -->

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

```hcl
resource "relyance_integration_connection" "grafana" {
  vendor = "grafana"
  name   = "<your connection name>"

  auth = {
    method = "service-account"
    params = {
      domain_url = "<domain_url>"
      loki_since = "1"
      loki_limit = "5000"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      service_account_token = var.grafana_service_account_token
      access_policy = var.grafana_access_policy
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->