QUERY LIBRARY / OPERATIONS

Queries you can actually use.

Thirty curated, copy-only query examples for metrics, logs, databases and APIs. Each explains its assumptions. Adapt queries to your field names, access permissions and retention policies.

✳ This page does not connect to external systems, run queries, request credentials or send any input to a server.

FIELD REFERENCE

Explore 30 practical queries

Review examples before running in authorized environments. API snippets use placeholder environment variables and never execute here.

Read the Field Guide ↗

Read-only examples; clipboard copies are performed locally.

PromQLQ01

HTTP 5xx error ratio

Adapt counter and status labels; zero traffic needs explicit handling.

sum(rate(http_requests_total{status=~"5.."}[5m])) / sum(rate(http_requests_total[5m]))

PromQLQ02

HTTP request throughput

Requires service label; per-second request rate.

sum by (service) (rate(http_requests_total[5m]))

PromQLQ03

P95 request latency

For classic histograms, not native histograms. Keep le in grouping.

histogram_quantile(0.95, sum by (le, service) (rate(http_request_duration_seconds_bucket[5m])))

PromQLQ04

CPU usage by instance

Process CPU seconds per second; multi-core may exceed one.

sum by (instance) (rate(process_cpu_seconds_total[5m]))

PromQLQ05

Node filesystem free ratio

Filesystem available fraction; deduplicate mount points as needed.

node_filesystem_avail_bytes{fstype!~"tmpfs|overlay"} / node_filesystem_size_bytes{fstype!~"tmpfs|overlay"}

LogQLQ06

Error lines by app

Change app label to your Loki schema; bounded time window recommended.

{app="example"} |~ "(?i)(error|exception|fatal)"

LogQLQ07

HTTP server errors

Assumes JSON logs containing a numeric status field.

{job="nginx"} | json | status >= 500

LogQLQ08

Request log counts

Aggregates log line counts, not measured HTTP requests.

sum by (app) (count_over_time({app=~".+"}[5m]))

LogQLQ09

Slow request extraction

JSON parser expects numeric duration_ms.

{app="example"} | json | duration_ms > 1000

LogQLQ10

Top error codes

Verify Loki pipeline and labels support range aggregation.

sum by (status) (count_over_time({app="example"} | json | status >= 500 [5m]))

PostgreSQL SQLQ11

PostgreSQL session states

Requires permission to view relevant session details.

SELECT state, count(*) AS sessions FROM pg_stat_activity GROUP BY state ORDER BY sessions DESC;

PostgreSQL SQLQ12

Long-running queries

Avoid displaying raw query text because it may include sensitive values.

SELECT pid, state, now() - query_start AS age, wait_event_type FROM pg_stat_activity WHERE state = 'active' AND query_start IS NOT NULL AND pid <> pg_backend_pid() ORDER BY query_start LIMIT 20;

PostgreSQL SQLQ13

Replication sender overview

Run on primary; visibility and columns vary by version.

SELECT application_name, state, sync_state, sent_lsn, write_lsn, flush_lsn, replay_lsn FROM pg_stat_replication;

PostgreSQL SQLQ14

Database size

Sizes are point-in-time estimates; may require permissions.

SELECT datname, pg_size_pretty(pg_database_size(datname)) AS size FROM pg_database WHERE datallowconn ORDER BY pg_database_size(datname) DESC;

PostgreSQL SQLQ15

Waiting relation locks

Summary only; count does not diagnose the blocking session.

SELECT mode, granted, count(*) AS sessions FROM pg_locks GROUP BY mode, granted ORDER BY count(*) DESC;

KQLQ16

Application failures in last hour

Azure Application Insights classic requests table; adapt for workspace schema.

requests | where timestamp > ago(1h) | where success == false | summarize failures=count() by bin(timestamp, 5m)

KQLQ17

Recent exception types

Assumes classic Application Insights exceptions table.

exceptions | where timestamp > ago(24h) | summarize count() by type | top 20 by count_

KQLQ18

Slow dependency calls

Duration column type and table naming vary.

dependencies | where timestamp > ago(1h) | where duration > 1s | summarize avg(duration), count() by name

KQLQ19

Heartbeat by computer

Azure Log Analytics Heartbeat table.

Heartbeat | where TimeGenerated > ago(1h) | summarize LastSeen=max(TimeGenerated) by Computer

KQLQ20

Azure Activity error operations

AzureActivity ingestion depends on diagnostic settings.

AzureActivity | where TimeGenerated > ago(24h) | where ActivityStatusValue == "Failure" | summarize Failures=count() by OperationNameValue

Splunk SPLQ21

Status code distribution

Change index, sourcetype, and status extraction to your environment.

index=main sourcetype=access_combined | stats count by status | sort -count

Splunk SPLQ22

Critical log messages

Case/field matching depends on the input and search mode.

index=main (ERROR OR FATAL OR CRITICAL) | stats count by host, sourcetype | sort -count

Splunk SPLQ23

Average request duration

Requires duration_ms field extraction.

index=main sourcetype=web_access | stats avg(duration_ms) as avg_ms by host

Splunk SPLQ24

One-hour error trend

Only meaningful if level field is extracted.

index=main earliest=-1h (ERROR OR WARN) | timechart span=5m count by level

Splunk SPLQ25

Top failing endpoints

Depends on status and uri_path extraction.

index=main sourcetype=web_access status>=500 | top limit=20 uri_path

HTTP API (read-only)Q26

GitHub repository metadata

Read-only GET; set token through environment, replace OWNER/REPO.

curl --fail-with-body --silent --show-error --max-time 15 -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${GITHUB_TOKEN}" https://api.github.com/repos/OWNER/REPO

HTTP API (read-only)Q27

Cloudflare zone details

Read-only GET; replace ZONE_ID, scope token minimally.

curl --fail-with-body --silent --show-error --max-time 15 -H "Authorization: Bearer ${CF_API_TOKEN}" https://api.cloudflare.com/client/v4/zones/ZONE_ID

HTTP API (read-only)Q28

Cloudflare DNS record listing

Read-only GET; exported response could disclose internal DNS.

curl --fail-with-body --silent --show-error --max-time 15 -H "Authorization: Bearer ${CF_API_TOKEN}" https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records

HTTP API (read-only)Q29

Grafana datasource list

Read-only GET; replace host; requires suitable read permissions.

curl --fail-with-body --silent --show-error --max-time 15 -H "Authorization: Bearer ${GRAFANA_TOKEN}" https://GRAFANA_HOST/api/datasources

HTTP API (read-only)Q30

Prometheus health query

Read-only query; authenticate to private endpoints as appropriate.

curl --fail-with-body --silent --show-error --max-time 15 -G --data-urlencode 'query=up' https://PROMETHEUS_HOST/api/v1/query

About these examples

All samples assume specific telemetry names, versions and permissions. Queries may require modification before they return meaningful data. Read-only SQL can still impose load on large systems; add limits and query timeouts appropriate to the environment. API examples use HTTPS placeholders; never publish tokens, system URLs or confidential results. This page provides no remote execution.