search-grafana-logslisted

# Search Grafana Logs ## When to use - User shares a Grafana dashboard/explore link or a Loki reference. - User says "search Loki", "check Grafana", or asks to search/investigate logs for an error or failure. - Not for a full bug diagnosis workflow (reproduce, minimise, hypothesise, fix) that happens to involve a log search, see the `diagnose` skill for that. Two ways this gets triggered: 1. A link: `https://grafana.<host>/d/<uid>/<slug>?...` or `https://grafana.<host>/explore?...`. 2. Just a problem description, no link at all: "find errors for request X", "why did job Y fail", "search yesterday's logs for `<id>`". Don't ask the user for a link, dashboard name, or LogQL syntax before trying, infer what's needed, see "Starting from a description only" below, and only ask if genuinely stuck. Either way, query Loki directly with `logcli`, Grafana Labs' own CLI for querying Loki. Don't use `curl`, the Grafana HTTP API, or anything else, `logcli` is the only tool this doc uses. This is not just a preference, it's usually the only path that works: Grafana's own UI/API commonly sits behind an additional identity proxy, Cloudflare Access, Okta, etc., that blocks a plain token from getting through, while Loki itself is frequently reachable directly over the same VPN/zero-trust network the user is already on, with no separate credential at all. If Loki genuinely isn't reachable this way, stop and tell the user, don't fall back to scraping the dashboard or calling the Grafana API