# Current value
node_cpu_seconds_total
# Rate over 5 minutes
rate(node_cpu_seconds_total[5m])
# Aggregation
sum by (instance) (rate(node_cpu_seconds_total{mode="idle"}[5m]))
# Recording rules (precomputed)
# Recorded as a new metric for fast querying
# Alerting rules
# When the expression is true for a duration, fire an alert
You don't need to write PromQL fluently, but recognise the shape: metric name, label filters in {}, time range in [], aggregations like sum, avg, max, rate, irate.