# Distinguish an absent Prometheus series from a measured zero

> Instant queries return samples subject to lookback and staleness rather than inventing a value for missing data.

- Canonical URL: https://update.dsesecurity.com/updates/distinguish-an-absent-prometheus-series-from-a-measured-zero/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:15:39+00:00
- Modified: 2026-10-20T18:34:33+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Instant queries return samples subject to lookback and staleness rather than inventing a value for missing data.

## Potentially affected

This concerns PromQL instant-selector behavior. Exporters supplying their own timestamps and environment-specific settings can introduce documented differences that require separate review.

## DSE recommendation

DSE recommends treating no data as an explicit state in dashboards and alert design.

## Article

Instant queries return samples subject to lookback and staleness rather than inventing a value for missing data.

## Source facts

Prometheus instant selection uses the newest sample within the lookback period. The default lookback is five minutes unless configured otherwise. A series marked stale is not returned for evaluations after that marker until new samples arrive. A missing result can therefore reflect collection or lifecycle state, rather than a numeric zero from the application.

Source: [Prometheus documentation — Querying basics](https://prometheus.io/docs/prometheus/latest/querying/basics/).

## Applicability

This concerns PromQL instant-selector behavior. Exporters supplying their own timestamps and environment-specific settings can introduce documented differences that require separate review.

## DSE recommendation

DSE recommends treating no data as an explicit state in dashboards and alert design. Compare target health, sample freshness, label changes, and query evaluation time before substituting a zero. Decide whether absent data should trigger a collection alert, an application alert, or an intentional inactive state. Keep the distinction visible in reports so a vanished workload cannot appear healthy merely because a display fills blanks. Record any lookback override with the query’s intended use.

## Verification

In a test scrape target, compare a real zero sample, a stopped export, and a changed label set. Inspect the instant query at relevant evaluation times and compare it with available historical samples. Confirm the dashboard and alert handle each condition according to the documented operational decision. Retain evaluation times, target identity and the actual returned samples beside the display behavior. Ask the dashboard owner to approve the absent-data state, including what a responder sees when collection itself has stopped.

## Official reference

[Prometheus documentation — Querying basics](https://prometheus.io/docs/prometheus/latest/querying/basics/). Reviewed October 20, 2026.

## Primary reference

- Name: Prometheus documentation — Querying basics
- Authority: prometheus.io
- URL: https://prometheus.io/docs/prometheus/latest/querying/basics/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Distinguish an absent Prometheus series from a measured zero,” DSE Security, https://update.dsesecurity.com/updates/distinguish-an-absent-prometheus-series-from-a-measured-zero/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.