Administration on Grafana Labs

Back up Grafana

Fri, 03 Apr 2026 19:43:06 +0000

Back up Grafana

This topic explains how to back up a local Grafana deployment, including configuration, plugin data, and the Grafana database.

Back up the Grafana configuration file

Copy Grafana configuration files that you might have modified in your Grafana deployment to a backup directory.

The Grafana configuration files are located in the following directories:

Default configuration: $WORKING_DIR/defaults.ini (Don’t change this file)
Custom configuration: $WORKING_DIR/custom.ini

For more information on where to find configuration files, refer to Configuration file location.

Note
If you installed Grafana using the deb or rpm packages, then your configuration file is located at /etc/grafana/grafana.ini. This path is specified in the Grafana init.d script using --config file parameter.

Back up plugin data

Installing plugins in Grafana creates a folder for each plugin with its associated files and data. Copy all files and folders recursively from this location to your backup repository.

The Grafana plugin files are located in the following directories:

Default location for plugins in a binary or source installation: $WORKING_DIR/data/plugins
Default location for plugins in a deb or rpm package: /var/lib/grafana/plugins. This path is specified in the Grafana init.d script using --config file parameter.

Back up the Grafana database

We recommend that you back up your Grafana database so that you can roll back to a previous version, if required.

SQLite

The default Grafana database is SQLite, which stores its data in a single file on disk. To back up this file, copy it to your backup repository.

Note
To ensure data integrity, shut down your Grafana service before backing up the SQLite database.

The SQLite database file is located in one of the following directories:

Default location for SQLite data in a binary or source installation: $WORKING_DIR/data/grafana.db
Default location for SQLite data in a deb or rpm package: /var/lib/grafana/grafana.db. This path is specified in the Grafana init.d script using --config file parameter.

MySQL

To back up or restore a MySQL Grafana database, run the following commands:

backup:
> mysqldump -u root -p[root_password] [grafana] > grafana_backup.sql

restore:
> mysql -u root -p grafana < grafana_backup.sql

Postgres

To back up or restore a Postgres Grafana database, run the following commands:

backup:
> pg_dump grafana > grafana_backup

restore:
> psql grafana < grafana_backup

Data source management

Fri, 03 Apr 2026 19:43:06 +0000

Data source management

Grafana supports many different storage backends for your time series data (data source). Refer to data sources for more information about using data sources in Grafana. Only users with the organization admin role can add data sources.

For links to data source-specific documentation, see Data sources.

Data source permissions

You can configure data source permissions to allow or deny certain users the ability to query, edit, or administrate a data source. Each data source’s configuration includes a Permissions tab where you can restrict data source permissions to specific users, service accounts, teams, or roles.

The query permission allows users to query the data source.
The edit permission allows users to query the data source, edit the data source’s configuration and delete the data source.
The admin permission allows users to query and edit the data source, change permissions on the data source and enable or disable query caching for the data source.

Note
Available in Grafana Enterprise and Grafana Cloud.

By default, data sources in an organization can be queried by any user in that organization. For example, a user with the Viewer role can issue any possible query to a data source, not just queries that exist on dashboards to which they have access. Additionally, by default, data sources can be edited by the user who created the data source, as well as users with the Admin role.

Assign data source permissions to users, service accounts, teams, or roles

You can assign data source permissions to users, service accounts, teams, and roles which will allow access to query, edit, or administrate the data source.

Click Connections in the left-side menu.
Under Your connections, click Data sources.
Select the data source to which you want to assign permissions.
On the Permissions tab, click Add a permission.
Select User, Service Account, Team, or Role.
Select the entity for which you want to modify permissions.
Select the Query, Edit, or Admin permission.
Click Save.

Edit data source permissions for users, service accounts, teams, or roles

Click Connections in the left-side menu.
Under Your connections, click Data sources.
Select the data source for which you want to edit permissions.
On the Permissions tab, find the User, Service Account, Team, or Role permission you want to update.
Select a different option in the Permission dropdown.

Remove data source permissions for users, service accounts, teams, or roles

Click Connections in the left-side menu.
Under Your connections, click Data sources.
Select the data source from which you want to remove permissions.
On the Permissions tab, find the User, Service Account, Team, or Role permission you want to remove.
Click the X next to the permission.

Query and resource caching

When you enable query and resource caching, Grafana temporarily stores the results of data source queries and resource requests. When you or another user submit the same query or resource request again, the results will come back from the cache instead of from the data source.

When using Grafana, a query pertains to a request for data frames to be modified or displayed. A resource relates to any HTTP requests made by a plugin, such as the Amazon Timestream plugin requesting a list of available databases from AWS. For more information on data source queries and resources, please see the developers page on backend plugins.

The caching feature works for all backend data sources. You can enable the cache globally in Grafana’s configuration, and configure a cache duration (also called Time to Live, or TTL) for each data source individually.

Note
Available in Grafana Enterprise and Grafana Cloud.

The following cache backend options are available: in-memory, Redis, and Memcached.

Note
Storing cached queries in-memory can increase Grafana’s memory footprint. In production environments, a Redis or Memcached backend is highly recommended.

When a panel queries a data source with cached data, it will either fetch fresh data or use cached data depending on the panel’s interval. The interval is used to round the query time range to a nearby cached time range, increasing the likelihood of cache hits. Therefore, wider panels and dashboards with shorter time ranges fetch new data more often than narrower panels and dashboards with longer time ranges.

A panel’s interval is visible in the query options. It is calculated as follows: time range / max data points. Max data points are calculated based on the width of the panel. For example, a wide panel with 1000 data points on a dashboard with a time range of last 7 days will retrieve fresh data every 10 minutes: 7d / 1000 = 10m. In this example, cached data for this panel will be served for up to 10 minutes before Grafana needs to query the data source again for new data.

You can configure a panel to retrieve data more often by increasing the Max data points setting in the panel’s query options.

Caching benefits

By reducing the number of queries and requests sent to data sources, caching can provide the following benefits:

Faster dashboard load times, especially for popular dashboards.
Reduced API costs.
Reduced likelihood that APIs will rate-limit or throttle requests.

Data sources that work with query caching

Query caching works for Grafana’s built-in data sources, and backend data source plugins that extend the DataSourceWithBackend class in the plugins SDK.

Note
Logs Insights for the CloudWatch data source does not support query caching due to the way logs are requested from AWS.

To verify that a data source works with query caching, follow the instructions below to Enable and Configure query caching. If caching is enabled in Grafana but the Caching tab is not visible for the given data source, then query caching is not available for that data source.

Note
Some data sources, such as Elasticsearch, Prometheus, and Loki, cache queries themselves, so Grafana query caching does not significantly improve performance. However, resource caching may help. Refer to plugin resources for details.

Enable and configure query caching

You must be an Org admin or Grafana admin to enable query caching for a data source. For more information on Grafana roles and permissions, refer to About users and permissions.

By default, data source queries are not cached. To enable query caching for a single data source:

Click Connections in the left-side menu.
Under Your Connections, click Data sources.
In the data source list, click the data source that you want to turn on caching for.
Go to the Cache tab.
Click Enable.
(Optional) Choose custom TTLs for the data source’s queries and resources caching. If you skip this step, then Grafana uses the default TTL.

You can optionally override a data source’s configured TTL for individual dashboard panels. This can be useful when you have queries whose results change more or less often than the configured TTL. In the Edit Panel view, select the caching-enabled data source, expand the Query options, and enter your the TTL in milliseconds.

Note
If query caching is enabled and the Cache tab is not visible in a data source’s settings, then query caching is not available for that data source.

To configure global settings for query caching, refer to the caching section of Configure Grafana Enterprise.

Disable query caching

To disable query caching for a single data source:

Click Connections in the left-side menu.
Under Your Connections, click Data sources.
In the data source list, click the data source that you want to turn off caching for.
On the Cache tab, click Disable.

To disable query caching for an entire Grafana instance, set the enabled flag to false in the caching section of Configure Grafana Enterprise. You will no longer see the Cache tab on any data sources, and no data source queries will be cached.

Clear cache

If you experience performance issues or repeated queries become slower to execute, consider clearing your cache.

Note
This action impacts all cache-enabled data sources. If you are using Memcached, the system clears all data from the Memcached instance.

Click Connections in the left-side menu.
Under Your Connections, click Data sources.
In the data source list, click the data source that you want to clear the cache for.
In the Cache tab, click Clear cache.

Sending a request without cache

If a data source query request contains an X-Cache-Skip header, then Grafana skips the caching middleware, and does not search the cache for a response. This can be particularly useful when debugging data source queries using cURL.

Plugin management

Fri, 03 Apr 2026 19:43:06 +0000

Plugin management

Plugins enhance your Grafana experience with new ways to connect to and visualize data.

Read on for an overview on how to get started with plugins:

Plugins are available in the plugin catalog. They can be built by Grafana Labs, commercial partners, our community, or you can build a plugin yourself.
There are three types of plugins: panel, data source, and app plugins.
Learn how to install, update and verify your plugins.

Advanced options allow you to:

Customize where app plugin pages appear in the navigation menu.
Configure backend communication between installed plugins.
Improve security by isolating plugins with the Plugin Frontend Sandbox.

Types of plugins

Grafana supports three types of plugins:

Panels - These plugins make it easy to create and add any kind of visualization, to show your data, or improve your favorite dashboards.
Data sources - These plugins allow you to pull data from various data sources such as databases, APIs, log files, and so on, and display it in the form of graphs, charts, and dashboards in Grafana.
Apps - These plugins enable the bundling of data sources, panels, dashboards, and Grafana pages into a cohesive experience.

Access the Plugin catalog

You can install and manage plugins from within Grafana. You need to have a Grafana Server administrator or Organization administrator role to access and use the plugin catalog. For more information about Grafana roles and permissions, refer to Roles and permissions.

For app plugins, the following access rules apply:

If you are an Org Admin, you can configure app plugins, but you can’t install, uninstall, or update them.
If you are a Server Admin, you can’t configure app plugins, but you can install, uninstall, or update them.
If you are both Org Admin and Server Admin, you can configure app plugins and also install, uninstall, or update them.

Browse plugins

To browse for available plugins:

While logged into Grafana as an administrator, click Administration > Plugins and data > Plugins in the side menu to view installed and available plugins.
Use the search box to filter based on name, keywords, organization and other metadata.
Click the Data sources, Panels, or Applications buttons to filter by plugin type.

If you’re not logged in, you can also access the list of available plugins in the Plugin catalog.

Manage your plugins

We strongly recommend running the latest plugin version. Use Grafana Advisor to check the status of your data sources and plugins.

Install a plugin

The most common way to install a plugin is through the Grafana UI.

In Grafana, click Administration > Plugins and data > Plugins in the side navigation menu to view all plugins.
Browse and find a plugin.
Click the plugin’s logo.
Click Install.

Note
To see additional ways to install plugins refer to Install a plugin.

Update a plugin

To update a plugin:

In Grafana, click Administration > Plugins and data > Plugins in the side navigation menu to view all plugins.
Click the Installed filter to show only installed plugins.
Click the plugin’s logo.
Click Update.

When the update is complete, a confirmation message will indicate the installation was successful.

Uninstall a plugin

To uninstall a plugin:

In Grafana, click Administration > Plugins and data > Plugins in the side navigation menu to view all plugins.
Click the plugin’s logo.
Click the Installed filter to show only installed plugins.
Click Uninstall.

When the update is complete, a confirmation message will indicate the installation was successful.

Verify your plugins

Plugin signature verification, also known as signing, is a security measure to make sure plugins haven’t been tampered with. Upon loading, Grafana checks to see if a plugin is signed or unsigned. Read more in Plugin signatures.

Advanced options

You can relocate app plugin pages to customize the navigation menu structure, as explained in Customize navigation placement of plugin pages.

Allow plugin backend communication

You can configure your Grafana instance to let the frontends of installed plugins directly communicate locally with the backends of other installed plugins. See how in Configure backend communication between installed plugins.

Isolate plugin code with the Frontend Sandbox

You can use the Plugin Frontend Sandbox to securely isolate plugin frontend code from the main Grafana application.

When enabled, plugins run in a separate JavaScript context, which provides several security benefits:

Prevents plugins from modifying parts of the Grafana interface outside their designated areas
Stops plugins from interfering with other plugins functionality
Protects core Grafana features from being altered by plugins
Prevents plugins from modifying global browser objects and behaviors

Learn more

To administer, update, or delete your plugins, or to submit a new plugin, sign in to the Plugins Admin page. Note that you need to be an administrator for the Grafana Cloud organization being used to publish the plugin.

Grafana Advisor

Fri, 03 Apr 2026 19:43:06 +0000

Grafana Advisor

Note
Grafana Advisor is available in public preview. Grafana Labs offers limited support, and breaking changes might occur prior to the feature being made generally available.

Currently, Grafana Advisor performs regular checks on data sources, plugins, and your Grafana instance, but we’re planning to expand its capabilities in future releases to cover more aspects of your Grafana environment. You can suggest new checks and provide feedback through this form.

Grafana Advisor is a monitoring tool that helps administrators keep their Grafana instances running smoothly and securely. It automatically performs regular health checks on your Grafana server, providing actionable insights and recommendations for maintaining optimal system performance.

Before you begin

To set up Grafana Advisor you need:

Administration rights in your Grafana organization.
If you’re running Grafana on-premise, enable the required feature toggle in your Grafana instance. Refer to Enable required feature toggles for instructions. If you’re using Grafana Cloud feature toggles are enabled by default.

Enable feature toggles

To activate Grafana Advisor, you need to enable the grafanaAdvisor feature toggle. This will automatically install the Grafana Advisor application to your server if it’s not already installed. For additional information about feature toggles, refer to Configure feature toggles.

To enable the required feature toggles, add them to your Grafana configuration file:

Open your Grafana configuration file, either grafana.ini or custom.ini. For file location based on the operating system, refer to Configuration file location.
Locate or add a [feature_toggles] section. Add this value:
ini
```
[feature_toggles]
grafanaAdvisor = true
```
Save the changes to the file and restart Grafana.

Access Grafana Advisor

To access Grafana Advisor:

Log in to your Grafana instance with an Administrator account.
Navigate to the Administration section on the left navigation menu.
Click Advisor.
If you’re a first time user, select Generate report to run Advisor and obtain your first report. From now on, reporting is automated and updated periodically.

Navigate the Advisor report

An Advisor report can contain the following tasks and action suggestions:

Note
You can configure which checks Advisor will run. See how in Configure application.

Action needed

This collapsible section displays issues requiring immediate attention. For each item, Grafana Advisor displays the specific name of the item that needs to be fixed. For data source issues, Grafana Advisor displays the specific data source name.

For each item, one or more buttons appear:

Fix the issue.
The Grafana Assistant sparkle icon, which will take you to the Assistant.
Retry the check.
Hide the error. If you hide an error you can see it again by clicking the Hide/Show silenced errors eye icon on the top right corner.

Investigation needed

This collapsible section provides information on issues that may not require immediate action but require your attention. For example, it provides information on plugins that require an upgrade. Similar to the Action needed section, clicking an item opens the plugin’s upgrade page. From there, you can either update to the latest version or select a specific version from the version history tab.

No action needed

This collapsible section provides more details about which checks have been performed and how many items have been analyzed. You can configure which checks Advisor will run. See how in Advisor menu > Configure application.

Use Grafana Advisor with Grafana Assistant

You can use Advisor with the Grafana Assistant, a purpose-built LLM in Grafana Cloud that allows you to troubleshoot incidents, manage resources, and answer product questions in minutes. The Assistant removes manual operations and speeds up response time. Strong privacy and security controls ensure conversations respect RBAC, route through vetted service providers, and rely on your telemetry to produce action-ready results.

If you click on the sparkle icon next to each issue detected, you will open a chat with the Assistant with all the existing information about the issue.

To learn more, refer to the Grafana Assistant documentation.

On the top right corner of the Advisor UI you have the following options and settings:

Refresh the report.
Configure application. Click the cogwheel button to access Grafana Advisor plugin settings, where you can enable or disable checks according to your preferences. Available checks cover configuration, installed plugins and data sources, Grafana instance versions, or SSO settings.
Hide/Show silenced issues.
Delete reports.

Address issues detected by Grafana Advisor

To maintain system reliability and keep your Grafana instance secure and up to date, regularly check the Advisor page to resolve issues flagged by Grafana Advisor:

Regular Monitoring: Check the Advisor page often to identify and address emerging issues.
Immediate Action: Address “Action needed” items promptly to ensure system reliability.
Systematic Review: After fixing flagged issues, use the “Refresh” button to confirm all checks pass.
Proactive Updates: Address plugin update recommendations under “Investigation needed” even if they haven’t caused failures yet.

You can also set up your own alerts with Grafana Alerting, which allows you to monitor your incoming data and set up alerts for specific events or circumstances. You can then create, manage, and take action on your alerts from a single, consolidated view.Refer to the Grafana Alerting documentation for more information.

Manage teams with Grafana Teams

Fri, 03 Apr 2026 19:43:06 +0000

Manage teams with Grafana Teams

Grafana Teams makes it easy to organize and administer groups of users in your enterprise. Teams allows you to grant permissions to a group of users instead of granting permissions to individual users one at a time.

Teams are useful in a wide variety of scenarios, such as when onboarding new colleagues or needing access to reports on secure financial data. When you add a user to a team, they get access to all resources assigned to that team.

Teams concepts

A Grafana Team is a group of users within an organization that have common permissions, including access to dashboards and data sources, and those permissions apply to all members of that team. For example, instead of assigning six users access to the same dashboard, you can create a team that consists of those users and assign dashboard permissions to the team. A user can belong to multiple teams.

A Team grants permissions to a wide variety of resources including:

dashboards
data sources
folders
alerts
reports
cloud access policies
annotations
playlists

Note
All members of a Grafana Team have the same exact permissions. A single Team can’t have members with different access levels to resources shared within that Team.

Additionally, when a user belongs to multiple Teams that have different permission levels for the same resource, the user receives the highest (most permissive) access level from any of their Teams. For example, if a user belongs to two Teams, one with Viewer access and another with Editor access to a folder, the user will have Editor access to that folder.

A user can be a Member or an Administrator for a given Team. Members of a Team inherit permissions from the team, but they don’t have team administrator privileges, and can’t edit the team itself. Team Administrators can add members to a team and update its settings, such as the team name, team member’s team roles, UI preferences, and home dashboard.

There are two types of Teams, isolated or collaborative. Isolated teams can only see their own resources. They can’t see other team’s resources like dashboards, data, or alerts. Collaborative teams have access to other team’s resources.

For information about how to optimize Teams, refer to How to best organize your teams and resources in Grafana.

Manage users

Fri, 03 Apr 2026 19:43:06 +0000

User management

A user is defined as any individual who can log in to Grafana. Each user is associated with a role that includes permissions. Permissions determine the tasks a user can perform in the system. For example, the Admin role includes permissions for an administrator to create and delete users.

Watch the following video to learn how to manage users and permissions in Grafana OSS and Grafana Cloud:

The following topics describe how to use permissions to control user access to data sources, dashboards, users, and teams.

Roles and permissions

Fri, 03 Apr 2026 19:43:06 +0000

Roles and permissions

A user is any individual who can log in to Grafana. Each user is associated with a role that includes permissions. Permissions determine the tasks a user can perform in the system. For example, the Admin role includes permissions for an administrator to create and delete users.

You can assign a user one of three types of permissions:

Grafana server administrator permissions: Manage Grafana server-wide settings and resources
Organization permissions: Manage access to dashboards, alerts, plugins, teams, playlists, and other resources for an entire organization. The available roles are Viewer, Editor, and Admin.
Dashboard and folder permission: Manage access to dashboards and folders. For a detailed explanation of how folders work as the primary permission boundary, refer to Folder access control.

Note
If you are running Grafana Enterprise, you can also control access to data sources and use role-based access control to grant user access to read and write permissions to specific Grafana resources. For more information about access control options available with Grafana Enterprise, refer to Grafana Enterprise user permissions features.

Note
For Grafana Cloud users, Grafana Support is not authorised to make org role changes. Instead, contact your org administrator.

Grafana server administrators

A Grafana server administrator (sometimes referred to as a Grafana Admin) manages server-wide settings and access to resources such as organizations, users, and licenses. Grafana includes a default server administrator that you can use to manage all of Grafana, or you can divide that responsibility among other server administrators that you create.

Caution
The server administrator role is distinct from the organization administrator role.

A server administrator can perform the following tasks:

Manage users and permissions
Create, edit, and delete organizations
View server-wide settings defined in the Configuration file
View Grafana server statistics, including total users and active sessions
Upgrade the server to Grafana Enterprise.

Note
The server administrator (Grafana Admin) role does not exist in Grafana Cloud.

To assign or remove server administrator privileges, see Server user management.

Organization users and permissions

All Grafana users belong to at least one organization. An organization is an entity that exists within your instance of Grafana.

Permissions assigned to a user within an organization control the extent to which the user has access to and can update the following organization resources:

dashboards and folders
alerts
playlists
users within that organization
data sources
teams
organization and team settings
plugins
annotations
library panels
service accounts

For more information about managing organization users, see User management.

Organization roles

Organization role-based permissions are global, which means that each permission level applies to all Grafana resources within an given organization. For example, an editor can see and update all dashboards in an organization, unless those dashboards have been specifically restricted using dashboard permissions.

Grafana uses the following roles to control user access:

Organization administrator: Has access to all organization resources, including dashboards, users, and teams.
Editor: Can view and edit dashboards, folders, and playlists.
Viewer: Can view dashboards, playlists, and query data sources.
No Basic Role: Has no permissions. Permissions will be added with RBAC as needed.

The following table lists permissions for each role.

Permission	Organization administrator	Editor	Viewer
View dashboards	yes	yes	yes
Add, edit, delete dashboards	yes	yes
Add, edit, delete folders	yes	yes
View playlists	yes	yes	yes
Add, edit, delete playlists	yes	yes
Create library panels	yes	yes
View annotations	yes	yes	yes
Add, edit, delete annotations	yes	yes
Access Explore	yes	yes
Query data sources directly	yes	yes	yes
Add, edit, delete data sources	yes
Add and edit users	yes
Add and edit teams	yes
Change organizations settings	yes
Change team settings	yes
Configure application plugins	yes

Dashboard permissions

When you want to extend a viewer’s ability to edit and save dashboard changes or limit an editor’s permission to modify a dashboard, you can assign permissions to dashboards and folders. For example, you might want a certain viewer to be able to edit a dashboard. While that user can see all dashboards, you can grant them access to update only one of them.

Important: The dashboard permissions you specify override the organization permissions you assign to the user for the selected entity.

You can specify the following permissions to dashboards and folders.

Admin: Can create, edit, or delete a dashboard. Can edit or delete a folder, and create dashboards and subfolders in a folder. Administrators can also change dashboard and folder permissions.
Edit: Can create, edit, or delete a dashboard. Can edit or delete a folder, and create dashboards and subfolders in a folder. Editors cannot change folder or dashboard permissions.
View: Can only view dashboards and folders.

Important: When a user creates a dashboard or folder at the top level, they are automatically granted Admin permissions for it. This does not apply to dashboards within a folder or to subfolders.

For more information about assigning dashboard folder permissions, refer to Grant dashboard folder permissions.

For more information about assigning dashboard permissions, refer to Grant dashboard permissions.

Teams and permissions

A team is a group of users within an organization that have common dashboard and data source permission needs. For example, instead of assigning five users access to the same dashboard, you can create a team that consists of those users and assign dashboard permissions to the team. A user can belong to multiple teams.

You can assign a team member one of the following permissions:

Member: Includes the user as a member of the team. Members do not have team administrator privileges.
Admin: Administrators have permission to manage various aspects of the team, including team membership, permissions, and settings.

Because teams exist inside an organization, the organization administrator can manage all teams.

For details on managing teams, see Team management.

Grafana Enterprise user permissions features

While Grafana OSS includes a robust set of permissions and settings that you can use to manage user access to server and organization resources, you might find that you require additional capabilities.

Grafana Enterprise provides the following permissions-related features:

Data source permissions
Role-based access control (RBAC)

Data source permissions

By default, a user can query any data source in an organization, even if the data source is not linked to the user’s dashboards.

Data source permissions enable you to restrict data source query permissions to specific Users, Service Accounts, and Teams. For more information about assigning data source permissions, refer to Data source permissions.

Role-based access control

RBAC provides you a way of granting, changing, and revoking user read and write access to Grafana resources, such as users, reports, and authentication.

For more information about RBAC, refer to Role-based access control.

Learn more

Want to know more? Complete the Create users and teams tutorial to learn how to set up users and teams.

Manage organizations

Fri, 03 Apr 2026 19:43:06 +0000

Manage organizations

This topic describes what organizations are, and how to create, edit, and delete them.

About organizations

An organization is an entity that helps you isolate users and resources such as dashboards, annotations, and data sources from each other. Their purpose is to provide completely separate experiences, which look like multiple instances of Grafana, within a single instance. Multiple organizations are easier and cheaper to manage than multiple instances of Grafana.

Users, configuration settings, and Grafana Enterprise licenses are shared between organizations. Other resources, like dashboards, data sources, annotations, folders, Teams, and Alerts, are isolated within each organization and cannot be easily shared with another organization.

The following table summarizes the resources you can share and/or isolate using organizations.

Resource	Mode
Users	Share or isolate
Folders	Isolate only
Dashboards	Isolate only
Data sources	Isolate only
Alerts	Isolate only
Notification channels	Isolate only
Annotations	Isolate only
Reports	Isolate only
Service accounts	Isolate only
Authentication providers	Share only
Configuration settings	Share only
Licenses	Share

The member of one organization cannot view dashboards assigned to another organization. However, a user can belong to multiple organizations.

Grafana Server Administrators are responsible for creating organizations. For more information about the Grafana Server Administrator role, refer to Grafana server administrators.

View a list of organizations

Complete this task when you want to view a list of existing organizations.

Before you begin

Ensure that you have Grafana Server Administrator permissions

To view a list of organizations:

Sign in to Grafana as a server administrator.
Click Administration in the left-side menu, General, and then Organizations.

Create an organization

Create an organization when you want to isolate dashboards and other resources from each other.

Before you begin

Ensure that you have Grafana Server Administrator permissions

To create an organization:

Sign in to Grafana as a server administrator.
Click Administration in the left-side menu, General, and then Organizations.
Click + New org.
Enter the name of the new organization and click Create.

Grafana creates the organization, adds you as the organization administrator, and opens the Default preferences page.
In the Preferences section, select a home dashboard, time zone, and week start.

For more information about preferences, refer to Preferences.

For more information about adding users to an organization, refer to Add a user to an organization.

Delete an organization

This action permanently removes an organization from your Grafana server.

Warning
Deleting the organization also deletes all teams and dashboards associated the organization.

Before you begin

Ensure that you have Grafana Server Administrator permissions
Because the delete action removes all teams and dashboards associated with the organization, ensure that the users who rely on the organization dashboards are aware of the change

To delete an organization:

Sign in to Grafana as a server administrator.
Click Administration in the left-side menu, General, and then Organizations.
Click the red X next to the organization that you want to delete.
Click Delete.

Edit an organization

Edit an organization when you want to change its name.

Before you begin

Ensure that you have Grafana Server Administrator permissions

To edit an organization:

Sign in to Grafana as a server administrator.
Click Administration in the left-side menu, General, and then Organizations.
Click the organization you want to edit.
Update the organization name and click Update.

Organization preferences

Fri, 03 Apr 2026 19:43:06 +0000

Organization preferences

Grafana preferences are basic settings. They control the Grafana UI theme, home dashboard, time zone, and so on.

Preferences are sometimes confusing because they can be set at four different levels, listed from highest level to lowest:

Server - Affects all users on the Grafana server. Set by a Grafana server admin.
Organization - Affects all users in an organization. Set by an Organization admin.
Team - Affects all users assigned to a team. Set by an Organization Admin or Team Admin. To learn more about these roles, refer to Teams and permissions.
User account - Affects the individual user. Set by the user on their own account.

The lowest level always takes precedence. For example, if a user sets their theme to Light, then their visualization of Grafana displays the light theme. Nothing at any higher level can override that.

If the user is aware of the change and intended it, then that’s great! But if the user is a Server Admin who made the change to their user preferences a long time ago, they might have forgotten they did that. Then, if that Server Admin is trying to change the theme at the server level, they’ll get frustrated as none of their changes have any effect that they can see. (Also, the users on the server might be confused, because they can see the server-level changes!)

Change Grafana name and email

In Grafana, you can change your names and emails associated with groups or accounts in the Settings or Preferences. This topic provides instructions for each task.

Some tasks require certain permissions. For more information about roles, refer to Roles and permissions.

Change organization name

Grafana server administrators and organization administrators can change organization names.

Grafana Server Admin change organization name

Follow these instructions if you are a Grafana Server Admin.

Click Administration in the left-side menu.
Click General.
Click Organizations.
In the organization list, click the name of the organization that you want to change.
In Name, enter the new organization name.
Click Update.

Organization Admin change organization name

If you are an Organization Admin, follow these steps:

Click Administration in the left-side menu.
Click General.
Click Default preferences.
In Organization name, enter the new name.
Click Update organization name.

Change team name or email

Organization administrators and team administrators can change team names and email addresses. To change the team name or email, follow these steps:

Click Administration in the left-side menu, Users and access, and select Team.
In the team list, click the name of the team that you want to change.
Click the Settings tab.
In the Team details section, you can edit the following:
- Name - Edit this field to change the display name associated with the team.
- Email - Edit this field to change the email address associated with the team.
Click Update.

Change user name or email

To learn how to edit your user information, refer to Edit your profile.

Change Grafana UI theme

In Grafana, you can modify the UI theme configured in the Settings or Preferences. Set the UI theme for the server, an organization, a team, or your personal user account using the instructions in this topic.

Some tasks require certain permissions. For more information about roles, refer to Roles and permissions.

Theme options

The theme affects how Grafana displays graphs, menus, other UI elements.

Default

Default is either the dark theme or the theme selected in a higher level. For example, if an Organization administrator set the Light theme, then that is the default for all the teams in that organization.

Dark

Here is an example of the dark theme.

Light

Here is an example of the light theme.

Experimental

There are several experimental themes that you can also choose from. To see the color scheme of a theme before selecting it for your organization, click the user icon in the top-right corner of the page and select Change theme. This opens the Change theme drawer, where you can view all themes.

Change server UI theme

As a Grafana server administrator, you can change the default Grafana UI theme for all users who are on the server by setting the default_theme option in the Grafana configuration file.

To see what the current settings are, refer to View server settings.

Change organization UI theme

Organization administrators can change the UI theme for all users in an organization.

Click Administration in the left-side menu.
Click General.
Click Default preferences.
In the Preferences section, select the UI theme.
Click Save.

Change team UI theme

Organization and team administrators can change the UI theme for all users on a team.

Click Administration in the left-side menu, Users and access, and select Teams.
Click the team for which you want to change the UI theme.
Click the Settings tab.
In the Preferences section, select the UI theme.
Click Save.

Change your personal UI theme

You can change the UI theme for your user account. This setting overrides UI theme settings at higher levels.

Click the user icon in the top right corner of the page and select Profile.
In the Preferences section, select the UI theme.
Click Save.

Change the Grafana default timezone

By default, Grafana uses the timezone in your web browser. However, you can override this setting at the server, organization, team, or individual user level. This topic provides instructions for each task.

Some tasks require certain permissions. For more information about roles, refer to Roles and permissions.

Set server timezone

Grafana server administrators can choose a default timezone for all users on the server by setting the default_timezone option in the Grafana configuration file.

Set organization timezone

Organization administrators can choose a default timezone for their organization.

Click Administration in the left-side menu.
Click General.
Click Default preferences.
Click to select an option in the Timezone list. Default is either the browser local timezone or the timezone selected at a higher level.
Click Save.

Set team timezone

Organization administrators and team administrators can choose a default timezone for all users on a team.

Click Administration in the left-side menu, Users and access, and select Teams.
Click the team for which you want to change the timezone.
Click the Settings tab.
Click to select an option in the Timezone list. Default is either the browser local timezone or the timezone selected at a higher level.
Click Save.

Set your personal timezone

You can change the timezone for your user account. This setting overrides timezone settings at higher levels.

Click the user icon in the top right corner of the page and select Profile.
Click to select an option in the Timezone list. Default is either the browser local timezone or the timezone selected at a higher level.
Click Save.

Change the default home dashboard

The home dashboard you set is the one all users will see by default when they log in. Click the Grafana icon or Home in the breadcrumb to return to it. You can set the home dashboard for the server, an organization, a team, or your personal user account. This topic provides instructions for each task.

Some tasks require certain permissions. For more information about roles, refer to Roles and permissions.

Set the home dashboard for the server

Users with the Grafana Server Admin flag on their account or access to the configuration file can define a JSON file to use as the home dashboard for all users on the server.

[Optional] Convert an existing dashboard into a JSON file

Navigate to the page of the dashboard you want to use as the home dashboard.
Click the Share button at the top right of the screen.
In the Export tab, click Save to file. Grafana converts the dashboard to a JSON file and saves it locally.

Use a JSON file as the home dashboard

Save your JSON file somewhere that Grafana can access it. For example, in the Grafana data folder of Grafana.
Update your configuration file to set the path to the JSON file. Refer to default_home_dashboard_path for more information about modifying the Grafana configuration files.

[dashboards]
# Path to the default home dashboard. If this value is empty, then Grafana uses StaticRootPath + "dashboards/home.json"
default_home_dashboard_path = data/main-dashboard.json

Note
On Linux, Grafana uses /usr/share/grafana/public/dashboards/home.json as the default home dashboard location.

Set the home dashboard for your organization

Organization administrators can choose a default home dashboard for their organization.

Navigate to the dashboard you want to set as the home dashboard.
Click the star next to the dashboard title to mark the dashboard as a favorite if it is not already.
Click Administration in the left-side menu.
Click General.
Click Default preferences.
In the Home Dashboard field, select the dashboard that you want to use for your home dashboard. Options include all starred dashboards.
Click Save.

Set home dashboard for your team

Organization administrators and Team Admins can set a default home dashboard for all users on a team.

Navigate to the dashboard you want to set as the home dashboard.
Click the star next to the dashboard title to mark the dashboard as a favorite if it is not already.
Click Administration in the left-side menu, Users and access, and select Teams.
Click the team for which you want to change the home dashboard.
Click the Settings tab.
In the Home Dashboard field, select the dashboard that you want to use for your home dashboard. Options include all starred dashboards.
Click Save.

Set your personal home dashboard

You can choose your own personal home dashboard. This setting overrides all home dashboards set at higher levels.

Navigate to the dashboard you want to set as the home dashboard.
Click the star next to the dashboard title to mark the dashboard as a favorite if it is not already.
Click the user icon in the top right corner of the page and select Profile.
In the Home Dashboard field, select the dashboard that you want to use for your home dashboard. Options include all starred dashboards.
Click Save.

Change Grafana language

Change server language

Grafana server administrators can change the default Grafana UI language for all users on the server by setting the default_language option in the Grafana configuration file.

Change organization language

Organization administrators can change the language for all users in an organization.

Click Administration in the left-side menu.
Click General.
Click Default preferences.
In the Preferences section, select an option in the Language dropdown.
Click Save.

Change team language

Organization and team administrators can set a default language for all users on a team.

Click Administration in the left-side menu, Users and access, and select Teams.
Click the team for which you want to change the language.
Click the Settings tab.
In the Preferences section, select an option in the Language dropdown.
Click Save.

Change your personal language

You can change the language for your user account. This setting overrides language settings at higher levels.

Click the user icon in the top right corner of the page and select Profile.
In the Preferences section, select an option in the Language dropdown.
Click Save.

Grafana server CLI

Fri, 03 Apr 2026 19:43:06 +0000

Administer Grafana with the Grafana server CLI

You can administer your Grafana instance with the Grafana server CLI, a small executable bundled with Grafana server.

The Grafana server CLI has plugins and admin commands, as well as global options. To list them, run:

grafana cli -h

For more details read on.

Run the Grafana server CLI

You can run the Grafana server CLI on the same machine Grafana server is running on.

To run the CLI you have the following options:

Add the path to the Grafana binaries in your PATH environment variable.
If your current directory is the bin directory, run ./grafana cli.
Otherwise, you can specify full path to the binary. For example, /usr/share/grafana/bin/grafana on Linux and C:\Program Files\GrafanaLabs\grafana\bin\grafana.exe on Windows.

The general syntax for commands in Grafana server CLI is:

grafana cli [global options] command [command options] [arguments...]

Note
Some commands, such as installing or removing plugins, require sudo on Linux. If you’re on Windows, run Windows PowerShell as Administrator.

Global options

Grafana server CLI allows you to temporarily override certain Grafana default settings. Except for --help and --version, most global options are only used by developers.

Each global option applies only to the command in which it is used. For example, --pluginsDir value does not permanently change where Grafana saves plugins. It only changes it for command in which you apply the option.

Display Grafana server CLI help

--help or -h displays the help, including default paths and Docker configuration information.

Example:

grafana cli -h

Display Grafana server CLI version

--version or -v prints the version of Grafana server CLI currently running.

Example:

grafana cli -v

Override default plugin directory

--pluginsDir value overrides the path to where your local Grafana instance stores plugins. Use this option if you want to install, update, or remove a plugin somewhere other than the default directory ("/var/lib/grafana/plugins") [$GF_PLUGIN_DIR].

Example:

grafana cli --pluginsDir "/var/lib/grafana/devplugins" plugins install <plugin-id>

Override default plugin repo URL

--repo value allows you to download and install or update plugins from a repository other than the default Grafana repo.

Example:

grafana cli --repo "https://example.com/plugins" plugins install <plugin-id>

Override default plugin .zip URL

--pluginUrl value allows you to download a .zip file containing a plugin from a local URL instead of downloading it from the default Grafana source.

Example:

grafana cli --pluginUrl https://company.com/grafana/plugins/<plugin-id>-<plugin-version>.zip plugins install <plugin-id>

Override Transport Layer Security

Warning: Turning off TLS is a significant security risk. We do not recommend using this option.

--insecure allows you to turn off Transport Layer Security (TLS) verification (insecure). You might want to do this if you are downloading a plugin from a non-default source.

Example:

grafana cli --insecure --pluginUrl https://company.com/grafana/plugins/<plugin-id>-<plugin-version>.zip plugins install <plugin-id>

Enable debug logging

--debug or -d enables debug logging. Debug output is returned and shown in the terminal.

Example:

grafana cli --debug plugins install <plugin-id>

Override a configuration setting

--configOverrides is a command line argument that acts like an environmental variable override.

For example, you can use it to redirect logging to another file (maybe to log plugin installations in Grafana Cloud) or when resetting the admin password and you have non-default values for some important configuration value (like where the database is located).

Example:

grafana cli --configOverrides cfg:default.paths.log=/dev/null plugins install <plugin-id>

Override homepath value

Sets the path for the Grafana install/home path, defaults to working directory. You do not need to use this if you are in the Grafana installation directory when using the CLI.

Example:

grafana cli --homepath "/usr/share/grafana" admin reset-admin-password <new password>

Override config file

--config value overrides the default location where Grafana expects the configuration file. Refer to Configuration for more information about configuring Grafana and default configuration file locations.

Example:

grafana cli --config "/etc/configuration/" admin reset-admin-password mynewpassword

Plugins commands

Grafana CLI allows you to install, upgrade, and manage your Grafana plugins. For more information about installing plugins, refer to plugins page.

All listed commands apply to the Grafana default repositories and directories. You can override the defaults with Global Options.

List available plugins

grafana cli plugins list-remote

Install the latest version of a plugin

grafana cli plugins install <plugin-id>

Install a specific version of a plugin

grafana cli plugins install <plugin-id> <version>

List installed plugins

grafana cli plugins ls

Update all installed plugins

grafana cli plugins update-all

Update one plugin

grafana cli plugins update <plugin-id>

Remove one plugin

grafana cli plugins remove <plugin-id>

Admin commands

Admin commands are only available in Grafana 4.1 and later.

Show all admin commands

grafana cli admin

Reset admin password

grafana cli admin reset-admin-password <new password> resets the password for the admin user using the CLI. You might need to do this if you lose the admin password. By default, this command uses the default ID of the admin user, which is 1. If you know the ID of the admin user, you can use the --user-id flag to specify the user ID. If the --user-id flag is not specified and the command cannot find the admin user, it returns the list of current admin users’ username and ID. From that list you can determine the ID of the admin user and run the command again with the --user-id flag.

If there are two flags being used to set the homepath and the config file path, then running the command returns this error:

Could not find config defaults, make sure homepath command line parameter is set or working directory is homepath

To correct this, use the --homepath global option to specify the Grafana default homepath for this command:

grafana cli --homepath "/usr/share/grafana" admin reset-admin-password <new password>

If you have not lost the admin password, we recommend that you change the user password either in the User Preferences or in the Server Admin > User tab.

If you need to set the password in a script, then you can use the Grafana User API.

Reset admin password

If you installed Grafana using Homebrew, you can reset the admin password using the following command:

/opt/homebrew/opt/grafana/bin/grafana cli --config /opt/homebrew/etc/grafana/grafana.ini --homepath /opt/homebrew/opt/grafana/share/grafana --configOverrides cfg:default.paths.data=/opt/homebrew/var/lib/grafana admin reset-admin-password <new password>

Reset admin password for Grafana deployed with Grafana Operator and using an external database

If you deploy Grafana with Grafana Operator and configure Grafana to use an external PostgreSQL or MySQL database, specify both the homepath and configuration file in your command:

grafana cli  --homepath /usr/share/grafana --config /etc/grafana/grafana.ini admin reset-admin-password <new password>

If you don’t do this, the CLI:

Won’t see the database connection information since it’s in a directory outside of the Grafana homepath
Will configure the default SQLite database in /var/lib/grafana and reset that password instead of for your external database

Migrate data and encrypt passwords

data-migration runs a script that migrates or cleans up data in your database.

encrypt-datasource-passwords migrates passwords from unsecured fields to secure_json_data field. Returns ok unless there is an error. Safe to execute multiple times.

Example:

grafana cli admin data-migration encrypt-datasource-passwords

Provision Grafana

Fri, 03 Apr 2026 19:43:06 +0000

Provision Grafana

Grafana has an active provisioning system that uses configuration files. You can define data sources and dashboards using files that can be version controlled, making GitOps more natural.

Configuration file

Refer to Configuration for more information on what you can configure in grafana.ini.

Configuration file locations

Grafana reads its default configuration from <WORKING DIRECTORY>/conf/defaults.ini.

Grafana reads custom configuration from <WORKING DIRECTORY>/conf/custom.ini. You can override the custom configuration path with the --config option.

Note
The Deb and RPM packages install the configuration file at /etc/grafana/grafana.ini. The Grafana init.d script sets the --config option to that path.

Use environment variables

You can use environment variable lookups in all provisioning configuration. The syntax for an environment variable is $ENV_VAR_NAME or ${ENV_VAR_NAME}.

The following applies:

Only use environment variables for configuration values. Do not use it for keys or bigger parts of the configuration file structure.
Use environment variables in dashboard provisioning configuration, but not in the dashboard definition files themselves.

The following example looks up the data source URL port, user, and password using environment variables:

datasources:
  - name: Graphite
    url: http://localhost:$PORT
    user: $USER
    secureJsonData:
      password: $PASSWORD

Use of the special character `$`

Grafana’s provisioning system considers any set of characters after an $ a variable name.

During the replacement process, Grafana:

Replaces the variables that use the syntax ${ENV_VAR_NAME}.
Next, it replaces the variables that use the syntax $ENV_VAR_NAME.

If your data contains the character $, for example Pa$sw0rd, and you’re using an environment variable, use the $ENV_VAR_NAME syntax to avoid double expansion. If you use the ${ENV_VAR_NAME} syntax, the value will be first replaced as Pa$sw0rd and then again as Pa since $sw0rd will be considered another variable.

If you want to use the literal value Pa$sw0rd, you need to escape the character $ using a double $$: Pa$$sw0rd.

The following example shows how variables are replaced, assuming PASSWORD=Pa$sw0rd:

datasources:
  - name: Graphite
    secureJsonData:
      password1: $PASSWORD # Resolved as Pa$sw0rd
      password2: ${PASSWORD} # Resolved as Pa
      password3: 'Pa$$sw0rd' # Resolved as Pa$sw0rd
      password4: 'Pa$sw0rd' # Resolved as Pa

Configuration management tools

The Grafana community maintains libraries for many popular configuration management tools.

Tool	Project
Puppet	https://forge.puppet.com/puppet/grafana
Ansible	https://github.com/grafana/grafana-ansible-collection
Chef	https://github.com/sous-chefs/chef-grafana
Saltstack	https://github.com/salt-formulas/salt-formula-grafana
Jsonnet	https://github.com/grafana/grafonnet-lib/)
NixOS	`services.grafana.provision` module

Data sources

You can manage data sources in Grafana by adding YAML configuration files in the provisioning/datasources directory. Each configuration file contains a list of data sources, under the datasources key, to add or update during startup. If the data source already exists, Grafana reconfigures it to match the provisioned configuration file.

You can also list data sources to automatically delete, using the key deleteDatasources. Grafana deletes the data sources listed in deleteDatasources before adding or updating those in the datasources list.

You can configure Grafana to automatically delete provisioned data sources when they’re removed from the provisioning file. To do so, add prune: true to the root of your data source provisioning file. With this configuration, Grafana also removes the provisioned data sources if you remove the provisioning file entirely.

Run multiple Grafana instances

If you run multiple instances of Grafana, add a version number to each data source in the configuration and increase it when you update the configuration. Grafana only updates data sources with the same or lower version number than the one set in the configuration file. This prevents old configurations from overwriting newer ones if you have different versions of the datasource.yaml file that don’t define version numbers, and then restart instances at the same time.

Example data source configuration file

This example provisions a Graphite data source:

# Configuration file version
apiVersion: 1

# List of data sources to delete from the database.
deleteDatasources:
  - name: Graphite
    orgId: 1

# Mark provisioned data sources for deletion if they are no longer in a provisioning file.
# It takes no effect if data sources are already listed in the deleteDatasources section.
prune: true

# List of data sources to insert/update depending on what's
# available in the database.
datasources:
  # <string, required> Sets the name you use to refer to
  # the data source in panels and queries.
  - name: Graphite
    # <string, required> Sets the data source type.
    type: graphite
    # <string, required> Sets the access mode, either
    # proxy or direct (Server or Browser in the UI).
    # Some data sources are incompatible with any setting
    # but proxy (Server).
    access: proxy
    # <int> Sets the organization id. Defaults to orgId 1.
    orgId: 1
    # <string> Sets a custom UID to reference this
    # data source in other parts of the configuration.
    # If not specified, Grafana generates one.
    uid: my_unique_uid
    # <string> Sets the data source's URL, including the
    # port.
    url: http://localhost:8080
    # <string> Sets the database user, if necessary.
    user:
    # <string> Sets the database name, if necessary.
    database:
    # <bool> Enables basic authorization.
    basicAuth:
    # <string> Sets the basic authorization username.
    basicAuthUser:
    # <bool> Enables credential headers.
    withCredentials:
    # <bool> Toggles whether the data source is pre-selected
    # for new panels. You can set only one default
    # data source per organization.
    isDefault:
    # <map> Fields to convert to JSON and store in jsonData.
    jsonData:
      # <string> Defines the Graphite service's version.
      graphiteVersion: '1.1'
      # <bool> Enables TLS authentication using a client
      # certificate configured in secureJsonData.
      tlsAuth: true
      # <bool> Enables TLS authentication using a CA
      # certificate.
      tlsAuthWithCACert: true
    # <map> Fields to encrypt before storing in jsonData.
    secureJsonData:
      # <string> Defines the CA cert, client cert, and
      # client key for encrypted authentication.
      tlsCACert: '...'
      tlsClientCert: '...'
      tlsClientKey: '...'
      # <string> Sets the database password, if necessary.
      password:
      # <string> Sets the basic authorization password.
      basicAuthPassword:
    # <int> Sets the version. Used to compare versions when
    # updating. Ignored when creating a new data source.
    version: 1
    # <bool> Allows users to edit data sources from the
    # Grafana UI.
    editable: false

For provisioning examples of specific data sources, refer to that data source’s documentation.

JSON data

Not all data sources have the same configuration settings, only the most common ones are fields in the data source provisioning file. To provision the rest of a data source’s settings, include them as JSON in the jsonData field.

Common settings in the built-in core data sources include:

Name	Type	Data source	Description
`tlsAuth`	boolean	HTTP*, MySQL	Enable TLS authentication using client cert configured in secure JSON data
`tlsAuthWithCACert`	boolean	HTTP*, MySQL, PostgreSQL	Enable TLS authentication using CA cert
`tlsSkipVerify`	boolean	HTTP*, MySQL, PostgreSQL, MSSQL	Controls whether a client verifies the server’s certificate chain and host name.
`serverName`	string	HTTP*, MSSQL	Optional. Controls the server name used for certificate common name/subject alternative name verification. Defaults to using the data source URL.
`timeout`	string	HTTP*	Request timeout in seconds. Overrides `dataproxy.timeout` option
`graphiteVersion`	string	Graphite	Graphite version
`timeInterval`	string	Prometheus, Elasticsearch, InfluxDB, MySQL, PostgreSQL and MSSQL	Lowest interval/step value that should be used for this data source.
`httpMode`	string	InfluxDB	HTTP Method. ‘GET’, ‘POST’, defaults to GET
`maxSeries`	number	InfluxDB	Max number of series/tables that Grafana processes
`httpMethod`	string	Prometheus	HTTP Method. ‘GET’, ‘POST’, defaults to POST
`customQueryParameters`	string	Prometheus	Query parameters to add, as a URL-encoded string.
`manageAlerts`	boolean	Prometheus and Loki	Manage alerts via Alerting UI
`alertmanagerUid`	string	Prometheus and Loki	UID of Alertmanager that manages Alert for this data source.
`timeField`	string	Elasticsearch	Which field that should be used as timestamp
`interval`	string	Elasticsearch	Index date time format. nil(No Pattern), ‘Hourly’, ‘Daily’, ‘Weekly’, ‘Monthly’ or ‘Yearly’
`logMessageField`	string	Elasticsearch	Which field should be used as the log message
`logLevelField`	string	Elasticsearch	Which field should be used to indicate the priority of the log message
`maxConcurrentShardRequests`	number	Elasticsearch	Maximum number of concurrent shard requests that each sub-search request executes per node
`sigV4Auth`	boolean	Elasticsearch and Prometheus	Enable usage of SigV4
`sigV4AuthType`	string	Elasticsearch and Prometheus	SigV4 auth provider. default/credentials/keys
`sigV4ExternalId`	string	Elasticsearch and Prometheus	Optional SigV4 External ID
`sigV4AssumeRoleArn`	string	Elasticsearch and Prometheus	Optional SigV4 ARN role to assume
`sigV4Region`	string	Elasticsearch and Prometheus	SigV4 AWS region
`sigV4Profile`	string	Elasticsearch and Prometheus	Optional SigV4 credentials profile
`authType`	string	Amazon CloudWatch	Auth provider. default/credentials/keys
`externalId`	string	Amazon CloudWatch	Optional External ID
`assumeRoleArn`	string	Amazon CloudWatch	Optional ARN role to assume
`defaultRegion`	string	Amazon CloudWatch	Optional default AWS region
`customMetricsNamespaces`	string	Amazon CloudWatch	Namespaces of Custom Metrics
`profile`	string	Amazon CloudWatch	Optional credentials profile
`tsdbVersion`	string	OpenTSDB	Version
`tsdbResolution`	string	OpenTSDB	Resolution
`sslmode`	string	PostgreSQL	SSL mode. ‘disable’, ‘require’, ‘verify-ca’ or ‘verify-full’
`tlsConfigurationMethod`	string	PostgreSQL	SSL certificate configuration, either by ‘file-path’ or ‘file-content’
`sslRootCertFile`	string	PostgreSQL, MSSQL	SSL server root certificate file, must be readable by the Grafana user
`sslCertFile`	string	PostgreSQL	SSL client certificate file, must be readable by the Grafana user
`sslKeyFile`	string	PostgreSQL	SSL client key file, must be readable by only the Grafana user
`encrypt`	string	MSSQL	Determines SSL encryption handling. Options include: `disable` - data sent between client and server is not encrypted; `false` - data sent between client and server is not encrypted beyond the login packet; `true` - data sent between client and server is encrypted. Default is `false`.
`postgresVersion`	number	PostgreSQL	Postgres version as a number (903/904/905/906/1000) meaning v9.3, v9.4, …, v10
`timescaledb`	boolean	PostgreSQL	Enable usage of TimescaleDB extension
`maxOpenConns`	number	MySQL, PostgreSQL and MSSQL	Maximum number of open connections to the database (Grafana v5.4+)
`maxIdleConns`	number	MySQL, PostgreSQL and MSSQL	Maximum number of connections in the idle connection pool (Grafana v5.4+)
`connMaxLifetime`	number	MySQL, PostgreSQL and MSSQL	Maximum amount of time in seconds a connection may be reused (Grafana v5.4+)
`keepCookies`	array	HTTP*	Cookies that needs to be passed along while communicating with data sources
`prometheusVersion`	string	Prometheus	The version of the Prometheus data source, such as `2.37.0`, `2.24.0`
`prometheusType`	string	Prometheus	Prometheus database type. Options are `Prometheus`, `Cortex`, `Mimir` or`Thanos`.
`cacheLevel`	string	Prometheus	Determines the duration of the browser cache. Valid values include: `Low`, `Medium`, `High`, and `None`.
`incrementalQuerying`	string	Prometheus	Experimental: Turn on incremental querying to enhance dashboard reload performance with slow data sources
`incrementalQueryOverlapWindow`	string	Prometheus	Experimental: Configure incremental query overlap window. Requires a valid duration string, for example, `180s` or `15m` Default value is `10m` (10 minutes).
`disableRecordingRules`	boolean	Prometheus	Experimental: Turn off Prometheus recording rules
`seriesEndpoint`	boolean	Prometheus	Using Prometheus `/api/v1/series` endpoint
`implementation`	string	Alertmanager	The implementation of the Alertmanager data source, such as `prometheus`, `cortex` or `mimir`
`handleGrafanaManagedAlerts`	boolean	Alertmanager	When enabled, Grafana-managed alerts are sent to this Alertmanager

Note
Data sources tagged with HTTP* communicate using the HTTP protocol, which includes all core data source plugins except MySQL, PostgreSQL, and MSSQL.

For examples of specific data sources’ JSON data, refer to that data source’s documentation.

Secure JSON data

Secure JSON data is a map of settings encrypted with a secret key. The encryption hides the JSON data from the users of Grafana. You should use secure JSON data to store TLS certificates and passwords for data source HTTP requests. All of these settings are optional.

Name	Type	Data source	Description
`tlsCACert`	string	HTTP*, MySQL, PostgreSQL	CA cert for out going requests
`tlsClientCert`	string	HTTP*, MySQL, PostgreSQL	TLS Client cert for outgoing requests
`tlsClientKey`	string	HTTP*, MySQL, PostgreSQL	TLS Client key for outgoing requests
`password`	string	HTTP*, MySQL, PostgreSQL, MSSQL	password
`basicAuthPassword`	string	HTTP*	password for basic authentication
`accessKey`	string	Amazon CloudWatch	Access key for connecting to Amazon CloudWatch
`secretKey`	string	Amazon CloudWatch	Secret key for connecting to Amazon CloudWatch
`sigV4AccessKey`	string	Elasticsearch and Prometheus	SigV4 access key. Required when using keys auth provider
`sigV4SecretKey`	string	Elasticsearch and Prometheus	SigV4 secret key. Required when using keys auth provider

Note
The HTTP* tag denotes data sources that communicate using the HTTP protocol, including all core data source plugins except MySQL, PostgreSQL, and MSSQL.

Custom HTTP headers for data sources

You can add HTTP headers to all requests sent to data sources managed by Grafana provisioning Configure the header name in the jsonData field and the header value in secureJsonData. The following example sets the HeaderName header to have the value HeaderValue and the Authorization header to have the value Bearer XXXXXXXXX:

apiVersion: 1

datasources:
  - name: Graphite
    jsonData:
      httpHeaderName1: 'HeaderName'
      httpHeaderName2: 'Authorization'
    secureJsonData:
      httpHeaderValue1: 'HeaderValue'
      httpHeaderValue2: 'Bearer XXXXXXXXX'

Plugins

You can manage plugin applications in Grafana by adding one or more YAML configuration files in the provisioning/plugins directory. Each configuration file contains a list of apps that Grafana configures during start up. Grafana configures each app to use the configuration in the file.

Note
This feature enables you to provision plugin configurations, not the plugins themselves. You must have already installed the plugin to use plugin configuration provisioning.

Example plugin configuration file

apiVersion: 1

apps:
  # <string> the type of app, plugin identifier. Required
  - type: raintank-worldping-app
    # <int> Org ID. Default to 1, unless org_name is specified
    org_id: 1
    # <string> Org name. Overrides org_id unless org_id not specified
    org_name: Main Org.
    # <bool> disable the app. Default to false.
    disabled: false
    # <map> fields that will be converted to json and stored in jsonData. Custom per app.
    jsonData:
      # key/value pairs of string to object
      key: value
    # <map> fields that will be converted to json, encrypted and stored in secureJsonData. Custom per app.
    secureJsonData:
      # key/value pairs of string to string
      key: value

Dashboards

You can manage dashboards in Grafana by adding one or more YAML configuration files in the provisioning/dashboards directory. Each configuration file contains a list of providers that Grafana uses to load dashboards from the local filesystem.

Example dashboard configuration file

apiVersion: 1

providers:
  # <string> an unique provider name. Required
  - name: 'a unique provider name'
    # <int> Org id. Default to 1
    orgId: 1
    # <string> name of the dashboard folder.
    folder: ''
    # <string> folder UID. will be automatically generated if not specified
    folderUid: ''
    # <string> provider type. Default to 'file'
    type: file
    # <bool> disable dashboard deletion
    disableDeletion: false
    # <int> how often Grafana will scan for changed dashboards
    updateIntervalSeconds: 10
    # <bool> allow updating provisioned dashboards from the UI
    allowUiUpdates: false
    options:
      # <string, required> path to dashboard files on disk. Required when using the 'file' type
      path: /var/lib/grafana/dashboards
      # <bool> use folder names from filesystem to create folders in Grafana
      foldersFromFilesStructure: true

When Grafana starts, it updates or creates all dashboards found in the configured path. These files can define the dashboard using the dashboard JSON:

{
  "dashboard": {
    "id": null,
    "uid": "example-dashboard",
    "title": "Production Overview",
    "tags": ["production", "monitoring"],
    "timezone": "browser",
    "schemaVersion": 16,
    "version": 0,
    "refresh": "30s"
  },
  "folderUid": "monitoring-folder",
  "overwrite": true
}

Or using a Kubernetes format, for example kubernetes-dashboard.json:

{
  "kind": "Dashboard",
  "apiVersion": "dashboard.grafana.app/v1beta1",
  "metadata": {
    "name": "dashboard-uid"
  },
  "spec": {
    "title": "Dashboard title",
    "panels": [
      {
        "gridPos": {
          "h": 13,
          "w": 24,
          "x": 0,
          "y": 0
        },
        "options": {
          "content": "<div><h1>Example panel</h1></div>",
          "mode": "html"
        },
        "transparent": true,
        "type": "text"
      }
    ]
  }
}

You must use the Kubernetes resource format to provision dashboards v2 / dynamic dashboards.

Note
Grafana installs dashboards at the root level if you don’t set the folder field.

Detect updates to provisioned dashboards files

After Grafana provisions your dashboards, it checks the filesystem for changes and updates dashboards as needed.

The mechanism Grafana uses to do this depends on your updateIntervalSeconds value:

More than 10 seconds: Grafana polls the path at that interval.
10 seconds or less: Grafana watches the filesystem for changes and updates dashboards when it detects them.

Note
When updateIntervalSeconds is 10 or less, Grafana relies on filesystem watch events to detect changes. Depending on your filesystem and how you mount or sync dashboard files (for example, Docker bind mounts or some network filesystems), those events might not reach Grafana. To work around this, set updateIntervalSeconds to more than 10 to force polling, or update your setup so filesystem watch events are propagated.

Make changes to a provisioned dashboard

You can make changes to a provisioned dashboard in the Grafana UI but its not possible to automatically save the changes back to the provisioning source. If allowUiUpdates is set to true and you make changes to a provisioned dashboard, when you save the dashboard, Grafana persists the changes to its database.

Caution
If you save a provisioned dashboard in the UI and then later update the provisioning source, Grafana always overwrites the database dashboard with the one from the provisioning file. Grafana ignores the version property in the JSON file, even if it’s lower than the dashboard in the database.

Caution
If you save a provisioned dashboard in the UI and remove the provisioning source, Grafana deletes the dashboard in the database unless you have set the option disableDeletion to true.

If you set allowUiUpdates to false, you can’t save changes to a provisioned dashboard. When you try to save changes to a provisioned dashboard, Grafana brings up a Cannot save provisioned dashboard dialog box.

Grafana offers options to export the JSON definition of a dashboard. Use either Copy JSON to Clipboard or Save JSON to file to sync your dashboard changes back to the provisioning source. Grafana removes the id field from the dashboard JSON to help the provisioning workflow.

The following screenshot illustrates this behavior.

Reusable dashboard URLs

If the dashboard in the JSON file contains an UID, Grafana updates that the dashboard with that UID in the database. This lets you migrate dashboards between Grafana instances and keep consistent dashboard URLs. When Grafana starts, it creates or updates all dashboards available in the configured folders.

Caution
You can overwrite existing dashboards with provisioning.

Be careful not to reuse the same title multiple times within a folder or uid within the same Grafana instance to avoid inconsistent behavior.

Provision folders structure from filesystem to Grafana

If you already store your dashboards using folders in a Git repository or on a filesystem, and want to have the same folder names in the Grafana menu, use foldersFromFilesStructure option.

For example, to replicate the following dashboards structure from the filesystem to Grafana:

/etc/dashboards
├── /server
│   ├── /common_dashboard.json
│   └── /network_dashboard.json
└── /application
    ├── /requests_dashboard.json
    └── /resources_dashboard.json

use the following provisioning configuration file:

apiVersion: 1

providers:
  - name: dashboards
    type: file
    updateIntervalSeconds: 30
    options:
      path: /etc/dashboards
      foldersFromFilesStructure: true

Grafana creates the server and application folders in the UI.

To use foldersFromFilesStructure, you must unset the folder and folderUid options.

To provision dashboards to the root level, store them in the root of your path.

Note
This feature doesn’t let you create nested folder structures, where you have folders within folders.

Alerting

For information on provisioning Grafana Alerting, refer to Provision Grafana Alerting resources.

Supported settings

The following sections detail the supported settings and secure settings for each alert notification type. In the provisioning YAML use settings for settings and secure_settings for secure settings. Grafana encrypts secure settings in the database.

Alert notification `pushover`

Name	Secure setting
`apiToken`	yes
`userKey`	yes
`device`
`priority`
`okPriority`
`retry`
`expire`
`sound`
`okSound`

Alert notification `discord`

Name	Secure setting
`url`	yes
`avatar_url`
`content`
`use_discord_username`

Alert notification `slack`

Name	Secure setting
`url`	yes
`recipient`
`username`
`icon_emoji`
`icon_url`
`uploadImage`
`mentionUsers`
`mentionGroups`
`mentionChannel`
`token`	yes
`color`

Alert notification `victorops`

Name
`url`
`autoResolve`

Alert notification `kafka`

Name
`kafkaRestProxy`
`kafkaTopic`

Alert notification `LINE`

Name	Secure setting
`token`	yes

Alert notification `MQTT`

Name	Secure setting
`brokerUrl`
`clientId`
`topic`
`messageFormat`
`username`
`password`	yes
`retain`
`qos`
`tlsConfig`

TLS configuration

Name	Secure setting
`insecureSkipVerify`
`clientCertificate`	yes
`clientKey`	yes
`caCertificate`	yes

Alert notification `pagerduty`

Name	Secure setting
`integrationKey`	yes
`autoResolve`

Alert notification `sensu`

Name	Secure setting
`url`
`source`
`handler`
`username`
`password`	yes

Alert notification `sensugo`

Name	Secure setting
`url`
`apikey`	yes
`entity`
`check`
`handler`
`namespace`

Alert notification `prometheus-alertmanager`

Name	Secure setting
`url`
`basicAuthUser`
`basicAuthPassword`	yes

Alert notification `teams`

Name	Secure setting
`url`

Alert notification `dingding`

Name	Secure setting
`url`

Alert notification `email`

Name	Secure setting
`singleEmail`
`addresses`

Alert notification `opsgenie`

Name	Secure setting
`apiKey`	yes
`apiUrl`
`autoClose`
`overridePriority`
`sendTagsAs`

Alert notification `telegram`

Name	Secure setting
`bottoken`	yes
`chatid`
`uploadImage`

Alert notification `threema`

Name	Secure setting
`gateway_id`
`recipient_id`
`api_secret`	yes

Alert notification `webhook`

Name	Secure setting
`url`
`http_method`
`username`
`password`	yes
`tls_config`
`hmac_config`

TLS configuration

Name	Secure setting
`insecureSkipVerify`
`clientCertificate`	yes
`clientKey`	yes
`caCertificate`	yes

HMAC signature configuration

Name	Secure setting
`secret`	yes
`header`
`timestampHeader`

Alert notification `googlechat`

Name	Secure setting
`url`

Alert notification `Cisco Webex Teams`

Name	Secure setting
`message`
`room_id`
`api_url`
`bot_token`	yes

Grafana Enterprise

Grafana Enterprise supports:

Service accounts

Fri, 03 Apr 2026 19:43:06 +0000

Service accounts

Service accounts allow you to run automated workloads in Grafana, such as dashboard provisioning, configuration, or report generation using the Grafana API.

Note the following:

A service account is not the same as a Grafana user.
Service accounts replace API keys as the primary way to authenticate applications that interact with Grafana.
Use service accounts to access the Grafana HTTP API (dashboards, users, data sources, alerts).
If you’re a Grafana Cloud user and need to send or query telemetry data (metrics, logs, traces), use Cloud Access Policies instead.
In Grafana Enterprise, you can combine service accounts with role-based access control to grant very specific permissions to applications that interact with Grafana.

When to use service accounts

Use service accounts and tokens to perform operations on automated or triggered tasks such as:

Authenticate applications, such as Terraform, with the Grafana API.
Schedule reports for specific dashboards to be delivered on a daily/weekly/monthly basis.
Define alerts in your system to be used in Grafana.
Set up an external SAML authentication provider.
Interact with Grafana without signing in as a user.

Service account benefits

The added benefits of service accounts to API keys include:

Service accounts resemble Grafana users and can be enabled/disabled, granted specific permissions, and remain active until they are deleted or disabled. API keys are only valid until their expiry date.
Service accounts can be associated with multiple tokens.
Unlike API keys, service account tokens are not associated with a specific user, which means that applications can be authenticated even if a Grafana user is deleted.
You can grant granular permissions to service accounts by leveraging role-based access control. For more information about permissions, refer to About users and permissions.

Service account limitations

Service accounts only work in the organization they are created for. If you have the same task that is needed for multiple organizations, create service accounts in each organization.

Service accounts can’t be used for instance-wide operations, such as global user management and organization management. These tasks require a user with Grafana server administrator permissions.

Service account tokens

A service account token is a generated random string that acts as an alternative to a password when authenticating with the Grafana HTTP API. Use service access tokens the same way as API Keys, for example to access Grafana HTTP API programmatically. Service account access tokens inherit permissions from the service account.

When you create a service account, you can associate one or more access tokens with it. Create multiple tokens for the same service account if:

Multiple applications use the same permissions, but you would like to audit or manage their actions separately.
You need to rotate or replace a compromised token.

Create a service account in Grafana

Use a service account to run automated workloads in Grafana, like dashboard provisioning, configuration, or report generation.

Note
To create service accounts via the API refer to Create a service account in the HTTP API.

Service account users

In order to create a service account, a user must have:

Admin rights, or
The roles fixed:roles:reader and fixed:serviceaccounts:creator

The user who creates a service account can read, update and delete the service account that they created, as well as the permissions associated with that service account.

Before you begin

Ensure you have permission to create and edit service accounts. By default, the organization administrator role is required to create and edit service accounts. For more information about user permissions, refer to About users and permissions.

Create a service account

Sign in to Grafana and click Administration in the left-side menu.
Click Users and access > Service accounts > Add service account.
Enter a Display name. The display name must be unique as it determines the ID associated with the service account.
- Use a consistent naming convention when you name service accounts. A consistent naming convention can help you scale and maintain service accounts in the future.
- You can change the display name at any time.
Click Create.

Add a token to a service account in Grafana

A service account token is a generated random string that acts as an alternative to a password when authenticating with Grafana’s HTTP API. For more information about service accounts, refer to About service accounts in Grafana.

You can create a service account token using the Grafana UI or via the API. For more information about creating a service account token via the API, refer to Create service account tokens using the HTTP API.

Before you begin

Service account token expiration dates

By default, service account tokens don’t have an expiration date. However, you can use token_expiration_day_limit to limit the expiration date of the token in days.

Add a token to a service account

Sign in to Grafana and click Administration in the left-side menu.
Click Users and access > Service accounts.
Click the service account to which you want to add a token.
Click Add service account token.
Enter a name for the token.
Optionally, you can select Set expiration date and enter an expiry date for the token.
- The expiry date specifies how long you want the key to be valid.
- If you are unsure of an expiration date, we recommend that you set the token to expire after a short time, such as a few hours or less. This limits the risk associated with a token that is valid for a long time.
Click Generate token.

Assign roles to a service account in Grafana

You can assign organization roles (Viewer, Editor, Admin) to a Grafana service account to control access for the associated service account tokens. To assign organization roles you can use the Grafana UI or the API. For more information about assigning a role to a service account via the API, refer to Update service account using the HTTP API.

In Grafana Enterprise, you can also assign RBAC roles to grant very specific permissions to applications that interact with Grafana.

Note
Since Grafana 10.2.0, the No Basic Role is available for organization users or service accounts. This role has no permissions. Grant permissions with RBAC.

Before you begin

Ensure you have permission to update service accounts roles. By default, the organization administrator role is required to update service accounts permissions. For more information about user permissions, refer to About users and permissions.

To assign a role to a service account

Sign in to Grafana and click Administration in the left-side menu.
Click Users and access.
Click Service accounts.
Click the service account to which you want to assign a role. As an alternative, find the service account in the list view.
Assign a role using the role picker to update.

Manage users and teams permissions for a service account in Grafana

To control what and who can do with the service account you can assign permissions directly to users and teams. You can assign permissions using the Grafana UI.

Before you begin

Make sure that you have the following permissions:

To update user and team permissions of a service accounts. By default, the organization administrator role is required to update user and teams permissions for a service account. For more information about user permissions, refer to About users and permissions.
To read teams.

User and team permissions for a service account

You can assign on of the following permissions to a specific user or a team:

Edit: A user or a team with this permission can view, edit, enable and disable a service account, and add or delete service account tokens.
Admin: User or a team with this permission will be able to everything from Edit permission, as well as manage user and team permissions for a service account.

To update team permissions for a service account

Sign in to Grafana and click Administration in the left-side menu.
Click Users and access.
Click Service accounts.
Click the service account for which you want to update team permissions a role.
In the Permissions section at the bottom, click Add permission.
Choose Team in the dropdown and select your desired team.
Choose View, Edit or Admin role in the dropdown and click Save.

To update user permissions for a service account

Sign in to Grafana and click Administration in the left-side menu.
Click Users and access.
Click Service accounts.
Click the service account for which you want to update team permissions a role.
In the Permissions section at the bottom, click Add permission.
Choose User in the dropdown and select your desired user.
Choose View, Edit or Admin role in the dropdown and click Save.

Debug the permissions of a service account token

Learn which RBAC permissions are attached to a service account token to diagnose permissions-related issues with token authorization.

Before you begin

If you haven’t added a token to a service account, do so before proceeding. Refer to Add a token to a service account to see how.

List a service account token’s permissions

To list your token’s permissions, use the /api/access-control/user/permissions endpoint.

Run the following command with the token whose permissions you want to check:

curl -H "Authorization: Bearer glsa_iNValIdinValiDinvalidinvalidinva_5b582697" -X GET '<grafana_url>/api/access-control/user/permissions' | jq

The output lists the token’s permissions:

Note
The following command output is shortened to show only the relevant content.

{
  "dashboards:read": ["dashboards:uid:70KrY6IVz"],
  "dashboards:write": ["dashboards:uid:70KrY6IVz"],
  "datasources.id:read": ["datasources:*"],
  "datasources:read": ["datasources:*"],
  "datasources:explore": [""],
  "datasources:query": ["datasources:uid:grafana"],
  "datasources:read": ["datasources:uid:grafana"],
  "orgs:read": [""]
}

Check which dashboards a token is allowed to see

To list which dashboards a token can view, filter the /api/access-control/user/permissions endpoint’s response for the dashboards:read permission key:

curl -H "Authorization: Bearer glsa_iNValIdinValiDinvalidinvalidinva_5b582697" -X GET '<grafana_url>/api/access-control/user/permissions' | jq '."dashboards:read"'

The output lists the dashboards a token can view and the folders a token can view dashboards from, by their unique identifiers (uid):

[
  "dashboards:uid:70KrY6IVz",
  "dashboards:uid:d61be733D",
  "folders:uid:dBS87Axw2",
],

View server statistics and license

Fri, 03 Apr 2026 19:43:06 +0000

View server statistics and license

This setting contains information about tools that Grafana Server Admins can use to learn more about their Grafana servers.

View Grafana server settings

Refer to Role-based access control in Grafana Enterprise to understand how you can control access with RBAC permissions.

If you are a Grafana server administrator, use the Settings tab to view the settings that are applied to your Grafana server via the Configuration file and any environmental variables.

Note: Only Grafana server administrators can access the Server Admin menu. For more information about about administrative permissions, refer to Roles and permissions.

View server settings

Log in to your Grafana server with an account that has the Grafana Admin flag set.
Click Administration in the left-side menu, General, and then Settings.

Available settings

For a full list of server settings, refer to Configuration.

View Grafana server stats

Refer to Role-based access control in Grafana Enterprise to understand how you can control access with RBAC permissions.

If you are a Grafana server admin, then you can view useful statistics about your Grafana server in the Stats & Licensing tab.

Note: Only Grafana server administrators can access the Server Admin menu. For more information about about administrative permissions, refer to Roles and permissions.

View server stats

Log in to your Grafana server with an account that has the Grafana Admin flag set.
Click Administration in the left-side menu, General, and then Stats and license.

Available stats

The following statistics are displayed in the Stats tab:

Total users Note: Total users = Total admins + Total editors + Total viewers
Total admins
Total editors
Total viewers
Active users (seen last 30 days) Note: Active users = Active admins + Active editors + Active viewers
Active admins (seen last 30 days)
Active editors (seen last 30 days)
Active viewers (seen last 30 days)
Active sessions
Total dashboards
Total orgs
Total playlists
Total snapshots
Total dashboard tags
Total starred dashboards
Total alerts

Counting users

If a user belongs to several organizations, then that user is counted once as a user in the highest organization role they are assigned, regardless of how many organizations the user belongs to.

For example, if Sofia is a Viewer in two organizations, an Editor in two organizations, and Admin in three organizations, then she would be reflected in the stats as:

Total users 1
Total admins 1

Create and configure announcement banner

Fri, 03 Apr 2026 19:43:06 +0000

An announcement banner shows at the top of every page in Grafana. You can use the announcement banner to communicate information to your users, such as maintenance windows, new features, or other important updates.

By default, only organization administrators can create announcement banners. You can customize who can create announcement banners with Role-based access control.

To create or update an announcement banner, follow these steps:

Click Administration > General > Announcement banner in the side navigation menu.

The Announcement banner page allows you to view, create, and update the settings for an announcement banner. Only one banner can be active at a time.
Toggle the Enable switch on to enable the announcement banner. You can disable the banner at any time with this toggle.
Enter the Message for the announcement banner. The message field supports Markdown.

To add a header, use the following syntax:
Markdown
```
### Header
```
To add a link, use the following syntax:
Markdown
```
[link text](https://www.example.com)
```
The preview of the configured banner appears on top of the form, under the Preview section.
Select the banner’s start date and time in the Starts at field. By default, the banner starts being displayed immediately. You can set a future date and time for the banner to start displaying.
Select the banner’s end date and time in the Ends at field. By default, the banner is displayed indefinitely. You can set a date and time for the banner to stop displaying.
Select the type of banner in the Variant field. This determines the color of the banner’s background.
Click Save to save the banner settings. The banner displays at the top of every page in Grafana between the start and end dates.

Grafana Enterprise license

Fri, 03 Apr 2026 19:43:06 +0000

Grafana Enterprise license

When you become a Grafana Enterprise customer, you gain access to Grafana’s premium observability features, including enterprise data source plugins, reporting, and role-based access control. In order to use these enhanced features of Grafana Enterprise, you must purchase and activate a Grafana Enterprise license.

To purchase a license directly from Grafana Labs, Contact a Grafana Labs representative. To activate an Enterprise license purchased from Grafana Labs, refer to Activate an Enterprise license.

You can also purchase a Grafana Enterprise license through the AWS Marketplace. To learn more about activating a license purchased through AWS, refer to Activate a Grafana Enterprise license purchased through AWS Marketplace.

Activate a Grafana Enterprise license purchased through AWS Marketplace

Activate an Enterprise license

Follow these steps to activate your Grafana Enterprise license:

Step 1. Download your license file

To download your Grafana Enterprise license:

Sign in to your Grafana Cloud account.
Go to My Account and select an organization from the drop-down menu at the top left of the page. On the Overview page for each organization, you can see a section for Grafana Enterprise licenses. Click Details next to a license.
If the license shows “License not configured” or if the URL is listed as “-”, you need to update the details. This requires the Admin role.
1. Click Update next to License Details. If the Update button isn’t visible, contact the Grafana account team.
2. Enter the URL. It must match the effective root_url configuration setting (including the trailing slash) of the Grafana Enterprise instance. It should be the URL that users type in their browsers to access the frontend, not the node hostname. The URL must start with “https://”, and it can’t be localhost or contain wildcards.
3. (Optional) Edit the license name. This name is only used for display purposes.
4. Click Save.
At the bottom of the license details page, select Download token to download the license.jwt file that contains your license.

Step 2. Add your license to a Grafana instance

You must install a Grafana Enterprise build to use the enterprise features, which you can download.

Note
If you already use Grafana OSS, you can replace it with the same version of Grafana Enterprise. Ensure that you back up the configuration and database before proceeding. For more information, refer to Back up Grafana.

There is more than one way to add the license to a Grafana instance:

Upload the license file via the Grafana server administrator page

This is the preferred option for single instance installations of Grafana Enterprise.

Sign in as a Grafana server administrator.
Click Administration > General > Stats and license in the side navigation menu.
Click Upload a new token.
Select your license file, and upload it.

Put the `license.jwt` file into the data directory of Grafana

On Linux systems, the data directory is usually at /var/lib/grafana.

You can also configure a custom location for the license file using the grafana.ini setting:

[enterprise]
license_path = /company/secrets/license.jwt

This setting can also be set with an environment variable, which is useful if you’re running Grafana with Docker and have a custom volume where you have placed the license file. In this case, set the environment variable GF_ENTERPRISE_LICENSE_PATH to point to the location of your license file.

Set the content of the license file as a configuration option

You can add a license by pasting the content of the license.jwt to the grafana.ini configuration file:

[enterprise]
license_text = eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0aGlzIjoiaXMiLCJub3QiOiJhIiwidmFsaWQiOiJsaWNlbnNlIn0.bxDzxIoJlYMwiEYKYT_l2s42z0Y30tY-6KKoyz9RuLE

This option can be set using the GF_ENTERPRISE_LICENSE_TEXT environment variable.

Step 3. Ensure that the license file’s root URL matches the root_url configuration option

Update the root_url in your configuration. It should be the URL that users type in their browsers to access the frontend, not the node hostname(s).

This is important, because as part of the validation checks at startup, Grafana compares the license URL to the root_url in your configuration.

In your configuration file:

[server]
root_url = https://grafana.example.com/

Or with an environment variable:

GF_SERVER_ROOT_URL=https://grafana.example.com/

Step 4. Restart Grafana

To finalize the installation of Grafana Enterprise, restart Grafana to enable all Grafana Enterprise features. Refer to restart Grafana for more information.

License expiration

If your license has expired, most of Grafana keeps working as normal. Some enterprise functionality stops or runs with reduced functionality and Grafana displays a banner informing the users that Grafana is running on an expired license. Your Grafana admin needs to upload a new license file to restore full functionality.

Replace your license as soon as possible. Running Grafana Enterprise with an expired license is unsupported and can lead to unexpected consequences.

Update your license

Locate your current license.jwt file. In a standard installation it is stored inside the Grafana data directory, which on a typical Linux installation is in /var/lib/grafana/data. This location might be overridden in the ini file Configuration.
ini
```
[enterprise]
license_path = /path/to/your/license.jwt
```
The configuration file’s location may also be overridden by the GF_ENTERPRISE_LICENSE_PATH environment variable.
Log in to your Grafana Cloud Account and make sure you’re in the correct organization in the dropdown at the top of the page.
Under the Grafana Enterprise section in the menu bar to the left, choose licenses and download the currently valid license with which you want to run Grafana. If you cannot see a valid license on Grafana.com, please contact your account manager at Grafana Labs to renew your subscription.
Replace the current license.jwt-file with the one you’ve just downloaded.
Restart Grafana.

If your license expires

If your Grafana Enterprise license expires, you can expect the following changes in feature behavior.

Data source permissions

Your current data source permissions will keep working as expected, but you’ll be unable to add new data source permissions until the license has been renewed.

LDAP authentication

LDAP synchronization is not affected by an expired license.
Team sync debugging is unavailable.

SAML authentication

SAML authentication is not affected by an expired license.

Role-based access control (RBAC)

Creating, updating and deleting custom roles is not available.
Modifying permissions for custom roles is not available.

Reporting

You’re unable to configure new reports or generate previews.
Existing reports continue to be sent.

Enterprise plugins

Enterprise plugins might stop working.

Custom branding

The custom branding feature is turned off, meaning that any custom branding options will not have any effect.

Usage insights

Exporting usage insights logs to Loki will be turned off for licenses expired for more than 7 days.

All the other usage insights features are turned off as soon as the license expires, meaning that you will not be able to see dashboard usage, presence indicators, or use improved search. Grafana continues to collect usage data and you will have access to it as soon as you update your license.

Vault integration

Vault integration is not affected by an expired license.

Auditing

Auditing is not affected by an expired license.

License restrictions

The concurrent session limit remains active for seven days after the expiration date, after which it will be turned off.

The active users limit is turned off immediately.

Settings updates at runtime

Settings updates at runtime are not affected by an expired license.

External users can’t access dashboards shared via email anymore. These dashboards are now private but you can make them public and accessible to everyone if you want to.

Grafana keeps your sharing configurations and restores them after you update your license.

Grafana Enterprise license restrictions

When you become a Grafana Enterprise customer, you receive a license that governs your use of Grafana Enterprise.

Active users limit

Your Grafana license includes a maximum number of active users.

An active user is a user who has signed in to Grafana within the last 30 days. This is a rolling window that is updated daily.
When you reach the maximum number of active users, only currently active users (users who have signed in over the past 30 days) can sign in. When a new user or a previously-inactive user tries to sign in, the user will see an error message indicating that Grafana has reached its license limit.
The user’s role, number of dashboards that a user can view or edit, and the number of organizations that they can access does not affect the active user count.
A license limit banner appears to administrators when Grafana reaches its active user limit; editors and viewers do not see the banner.

Determine the number of active users

To determine the number of active users:

Sign in to Grafana Enterprise as a System Administrator.
Click Administration in the side navigation menu.
Click General.
Click Stats and license.
Review the utilization count on the Utilization panel.

Tiered licensing (deprecated)

A tiered license defines dashboard viewers, and dashboard editors and administrators, as two distinct user types that each have their own user limit.

Grafana only counts and enforces the total number of active users in your Grafana instance. For example, if you purchase 150 active users, you can have 20 admins, 70 editors, and 60 viewers, or you can have 150 admins. Grafana will enforce the total number of active users even if you use a license that grants a specific number of admins or editors and a certain number of viewers. This is a more permissive policy than before, which gives you the flexibility to change users’ roles.

If you are running a pre-9.0 version of Grafana Enterprise, please refer to the documentation for that version to learn more about license enforcement in your current version.

Additional license restrictions

Your license is controlled by the following rules:

License expiration date: The license includes an expiration date, which is the date when a license becomes inactive.

As the license expiration date approaches, you will see a banner in Grafana that encourages you to renew. To learn about how to renew your license and what happens in Grafana when a license expires, refer to License expiration.

License token expiration: Grafana Enterprise requires a valid token, which is automatically renewed.

A license token is a digital key that activates your license. By default, the license token is renewed every 24 hours by calling the Grafana API. Short-lived license tokens enable more frequent validation that licenses are compliant, and allow for more frequent license updates - for example, adding users or invalidating a compromised license.

To view the details of your license token, sign in to Grafana Enterprise as a Server Administrator and visit Administration > General > Statistics and licensing. Token details are in the Token section under License Details.

License token renewal requires internet access, and requires that the auto_refresh_license configuration setting be set to true. If your Grafana Enterprise instance cannot connect to the internet, contact your Grafana Labs account team for additional options for token renewal and license audit.

Grafana License URL: Your license does not work with an instance of Grafana with a different root URL.

The License URL is the complete URL of your Grafana instance, for example https://grafana.your-company.com/. It is defined in the root_url configuration setting.

Concurrent sessions limit: As of Grafana Enterprise 7.5, users can initiate up to three concurrent sessions of Grafana.

The system creates a session when a user signs in to Grafana from a new device, a different browser, or an incognito window. If a user signs in to Grafana from another tab or window within the same browser, only one session is used.

When a user reaches the session limit, the fourth connection succeeds and the longest inactive session is signed out.

Request a change to your license

To increase the number of licensed users within Grafana, extend a license, or change your licensed URL, contact Grafana support or your Grafana Labs account team. They will update your license, which you can activate from within Grafana.

For instructions about how to activate your license after it is updated, refer to Activate an Enterprise license.

Usage billing

Standard Grafana Enterprise licenses include a certain number of seats that can be used, and prevent more users logging into Grafana than have been licensed. This makes sense if you prefer a predictable bill. It can however be a problem if you anticipate uneven usage patterns over time or when it’s critical that no user ever be prevented from logging in to Grafana due to capacity constraints.

For those use-cases we support usage-based billing, where your license includes a certain number of included users and you are billed on a monthly basis for any excess active users during the month.

Usage billing involves a contractual agreement between you and Grafana Labs and an update to your license, and it is only available if Grafana Enterprise version 10.0.0 or higher is configured to automatically refresh its license token.

User deduplication

If your organization has multiple Grafana Enterprise instances with usage billing enabled, then each active user counts only once toward your license, regardless of how many instances that user signs into. Each Grafana Enterprise instance submits a hashed list of users to Grafana Labs via API every day. Each user email address or anonymous device ID is hashed using a one-way sha256 algorithm, and submitted to Grafana where the hashed users are deduplicated across instances.

Request usage billing

To request usage billing, contact your Grafana Labs account team or submit a support ticket.

Correlations

Fri, 03 Apr 2026 19:43:06 +0000

Correlations

You can create interactive links for Explore visualizations by setting up Correlations. These links can either run queries or generate external URLs related to presented data.

A correlation defines how data in one data source is used to query data in another data source or to generate an external URL. Some examples:

an application name returned in a logs data source can be used to query metrics related to that application in a metrics data source, or
a user name returned by an SQL data source can be used to query logs related to that particular user in a logs data source
a customer ID in a logs data source can link to a different platform that has a profile on that customer.

Explore takes user-defined correlations to display links inside the visualizations. If a correlation links to a query, you can click on that link to run the related query and see results in Explore Split View. If a correlation links to an external URL, you can click on the link to open the URL in a new tab in your browser.

Explore visualizations that currently support showing links based on correlations:

You can configure correlations using provisioning, the Administration > Plugins and data > Correlations page in Grafana or directly in Explore.

Example of how links work in Explore once set up

Migrate from Grafana OSS/Enterprise to Grafana Cloud

Fri, 03 Apr 2026 19:43:06 +0000

Migrate from Grafana OSS/Enterprise to Grafana Cloud

When you decide to migrate from your self-managed Grafana instance to Grafana Cloud, you can benefit from the convenience of a managed observability platform, additional cloud-only features, and robust security. There are a couple of key approaches to help you transition to Grafana Cloud.

Migration type	Tools used	Availability	Migratable resources
Manual	Command line utilities The Grafana HTTP API	Generally available in all versions of Grafana OSS/Enterprise	The entire Grafana instance
Automated	The Grafana Cloud Migration Assistant	Generally available in Grafana v12 and available in public preview from Grafana v11.2 to v11.6 using the `onPremToCloudMigrations` feature toggle. This toggle is enabled by default in Grafana v11.5 and later.	Dashboards Folders Data sources App Plugins Panel Plugins Library Panels Grafana Alerting resources

Our detailed migration guide explains the key steps and scripts to manually migrate your resources to Grafana Cloud, covering a comprehensive set of resources in your Grafana instance. Alternatively, the Grafana Cloud Migration Assistant, available in public preview in Grafana v11.2 and later, automates the migration process across a broad range of Grafana resources. You can use the migration assistant to migrate a large proportion of your Grafana resources and then, if needed, leverage the migration guide to migrate the rest.

Search

Fri, 03 Apr 2026 19:43:06 +0000

Grafana search

Use the command palette to search all of Grafana and to initiate key actions from any page in the application.

Command palette

The command palette allows you to:

Search for and open dashboards and folders
Create dashboards and alert rules
Locate pages within Grafana
Change the theme to dark or light
Run Sift investigations

To open the command palette, press cmd+K in macOS or ctrl+k in Linux/Windows. You can also click on the input located in the navigation bar.

Note
To go to the previous step, press backspace with the command palette input empty.

Recorded queries (deprecated)

Fri, 03 Apr 2026 19:43:06 +0000

Recorded queries (deprecated)

Warning
Recorded queries are deprecated. Please use the new Grafana-managed recording rules instead.

To learn how to migrate your recorded queries to Grafana-managed recording rules, refer to the migration documentation here.

Recorded queries allow you to see trends over time by taking a snapshot of a data point on a set interval. This can give you insight into historic trends.

For our plugins that do not return time series, it might be useful to plot historical data. For example, you might want to query ServiceNow to see a history of request response times but it can only return current point-in-time metrics.

Note
Available in Grafana Enterprise and Grafana Cloud.

How recorded queries work

Note
An administrator must configure a Prometheus data source and associate it with a Remote write target before recorded queries can be used.

Recorded queries only work with backend data source plugins. Refer to Backend data source plugin for more information about backend data source plugins. You can recorded four types of queries:

single row and column - A query that returns a single row and column.
row count - A query that returns meaningful rows to be counted.
expression - Any expression. To learn more about creating and using expressions, see Write expression queries.
dataplane numeric - A query that returns dataplane numeric kind data.

After a recorded query is created or enabled, it immediately creates a snapshot and continues to create snapshots at the set interval. The recorded query stops taking snapshots when it is disabled, deleted, or when Grafana is not running. Data points are gathered in the backend by running the recorded query and forwarding each result to a remote-write enabled Prometheus instance.

Using a recorded query

To use a recorded query, create one and add it to a dashboard. After that, it can be managed in Preferences from the Recorded queries tab.

Create a recorded query

Find/create a query you want to record on a dashboard in an edit panel. The query must only return one row and column. If it returns more, you can still record the number of results returned using the “count” option.
- The query’s data source must be a backend data source.
- Expressions can be used to aggregate data from a time series query. Refer to Write expression queries to learn more about creating and using expressions.
Click the record query button located in the top right of the query editor.
Enter recorded query information. All fields are required unless otherwise indicated.
- Name - Name of the recorded query.
- Description - (optional) Describe the recorded query as you want it to appear in the recorded query list.
- Interval - The interval on which the snapshot will be taken. The interval starts when you create the recorded query and will stop if you pause or delete the recorded query. Refer to Managing recorded queries for more information on pausing and deleting recorded queries.
- Range - The relative time range of the query. If you select a range of 30m and an interval of 1h the query will take a snapshot every hour of the past 30 minutes.
- Count query results - If you want to count the rows returned from your query toggle this option on. If this option is off, your query must return one row with one value.
Test your recorded query by clicking the test recorded query button.
Click Start recording query to start recording your query.

Add a recorded query

You can add existing recorded queries to panels in a dashboard. For each recorded query that you add, a Prometheus query is created: generated_recorded_query_name{id="generated_id", name="recorded query name"}. The created query from Prometheus returns all the recorded query’s gathered snapshots.

Navigate to a panel in a dashboard where you wish to add a recorded query.
Click the + Recorded query button located below the queries.
If you want to filter recorded queries by data source, select a data source from the filter by data source drop down menu.
Click the Add button on your recorded query to add it to the panel.

After adding your recorded query to the panel, the panel data source will become -- Mixed --. Your recorded query is represented by a Prometheus query with a name label matching your recorded query name. Refer to Prometheus to learn more about the Prometheus data source.

If after adding a recorded query, a query with a -- Mixed -- data source instead of Prometheus data source appears, this could mean that a Prometheus remote write target was not set up for recorded queries. Refer to Remote write target to set up a remote write point.

Manage recorded queries

Recorded queries can be paused/activated and deleted from the Recorded queries tab in Preferences. Deleting a recorded query will remove it from Grafana, but the information that was gathered in Prometheus will still be there. Pausing a recorded query will no longer gather new data points until it is resumed.

Remote write target

The remote write target is the Prometheus data source that recorded query data points are written to. You will need a Prometheus with remote write enabled and you will need to create a data source for this Prometheus.

The remote write target can be edited by clicking Edit Remote Write Target in the upper right on the Recorded Queries tab in Preferences. Select the Prometheus data source that has remote write enabled and enter the remote write path.