A Grafana dashboard variable named `service` is multi-value with 'Include All' enabled. Explain what Grafana actually substitutes into a panel's query text when the user selects two services or 'All', and how format modifiers such as `${service:regex}`, `${service:pipe}`, `${service:csv}`, `${service:sqlstring}` and `${service:raw}` change that.

## Interpolation is string substitution Before a panel's query leaves Grafana, every `$variable` reference in the query text is replaced with the current selection. There is no parameter binding: the data source receives a finished string. Everything else in this topic follows from that single fact — the escaping problem, the `All` blow-up, and the injection risk. ## Reference syntax - `$service` — the plain form; works when the next character cannot be part of an identifier. - `${service}` — the braced form; required when the reference abuts other text (`${service}_total`), and required to attach a format. - `[[service]]` — a legacy form still parsed but deprecated; do not write new dashboards with it. - `${service:format}` — explicit formatting. Variables interpolate in more than queries: panel titles, text panels, data links, and the queries of *other* variables. ## Single value versus multi-value With multi-value off, the substitution is the selected value verbatim (subject to escaping). With multi-value on, Grafana must turn a *list* into something the target query language understands, and there is no universal answer — hence formats. The data source plugin declares a default: a Prometheus-style source formats as a regex alternation `(auth|billing)` so the query must use a regex-match operator rather than equality; a Graphite-style source formats as a glob `{auth,billing}`; SQL sources format as quoted CSV so the variable belongs inside an `IN (...)`. This is the most common real defect: the panel query uses `label="$service"` (exact match), works fine for one selection, and returns nothing the moment a second value is selected because the substituted text is now `(auth|billing)` compared with `=`. The fix is to write the query for the format you asked for — regex-match operator for regex format. ## The format modifiers - `regex` — escapes each value for regex safety and joins with `|` inside a group. - `pipe` — `a|b` with no grouping. - `csv` — `a,b`. - `json` — a JSON array. - `singlequote` / `doublequote` — quotes each element and joins with commas. - `sqlstring` — single-quotes each element *and* escapes embedded quotes; the correct choice for SQL sources. - `glob` — `{a,b}`. - `lucene` — an OR-joined Lucene clause for search backends. - `percentencode` / `queryparam` — URL-safe; `queryparam` emits `var-service=a&var-service=b`, which is exactly what you need when building a data link to another dashboard that carries the current selection. - `distributed` — repeats the variable name per value, for query languages that need `series, name=a, name=b`. - `text` — the *display label* rather than the value; handy in panel titles when the value is an opaque id. - `raw` — no escaping whatsoever. It exists for the case where the variable holds a fragment of query syntax you deliberately want inlined. ## The `All` option `Include All` adds an `All` entry whose default behaviour is to expand to **every option in the list**, formatted like any other multi-selection. On a variable with 800 pods, that produces an enormous regex or IN-list; you can hit query-length limits, blow up the backend's parse time, or simply make the dashboard slow for no benefit. The remedy is the **custom all value**: set it to `.*` for a regex-matched source or `%` for SQL-style `LIKE`, and Grafana substitutes that single token instead of enumerating. The trade-off is that a wildcard also matches values that were never in the option list — usually what you want, occasionally not (a dashboard scoped by a filtered variable will silently widen). ## Injection Because interpolation is textual, a Text box variable or a value pulled from a query is untrusted input pasted into a query string. For SQL data sources this is straightforward SQL injection, and the mitigation is the same as anywhere: prefer the structured/typed path where the data source offers one, otherwise use `${var:sqlstring}` so quotes are escaped, and treat `:raw` as an explicit decision that this variable is trusted dashboard-author content, never end-user content. Grafana's own permissions model matters here too: a viewer who can edit a panel query on an ad-hoc basis inherits the dashboard's data-source credentials. ## Diagnosing The panel inspector's *Query* tab shows the fully interpolated query that was actually sent. When a panel is empty after a multi-select, read that string first: nine times out of ten you will see `(a|b)` sitting next to an `=` operator, or an `All` expansion that never fit. ## How to answer State 'textual substitution before the query is sent', then multi-value formatting with one concrete mismatch example, then `All` expansion versus custom all value, and close on `:raw` being an escaping opt-out with an injection consequence.