In this example, the query filter events in the humio repository that are tagged with kind equal to logs and then returns the events where the class field has values containing c.h.j.RunningQueriesLoggerJob, searching for the specific value Highest Cost query. The query then combines the results in a new field repoUser. The query then uses top() and table() functions to aggregate and display the results.

Example incoming data might look like this:

The query is used to search across multiple repositories and calculate query costs per user, by combining costs and showing the repository/user as a single field.

Sample output from the incoming example data:

In this example, the top() is used to count occurrences of repository names in the field repo, followed by the format() function to create clickable links for each repository.

Example incoming data might look like this:

The query is used to analyze the frequency of repository interactions and create clickable links for each repository.

This query is useful, for example, to create interactive reports showing which repositories are most actively used, or to build dashboards where users can quickly access frequently accessed repositories.

Sample output from the incoming example data:

Note that the results are automatically sorted by count in descending order, showing the most frequently accessed repositories first. The original field value is preserved in the repo field while the formatted link is available in the link field.

In this example, the regex() function is used to extract page names from URLs, and then top() is used to identify the most frequently accessed pages.

Example incoming data might look like this:

The query is used to analyze the most frequently accessed pages on a website by extracting page names from URLs and counting their occurrences.

This query is useful, for example, to identify popular content, monitor user behavior patterns, or detect potential issues with specific pages that receive high traffic.

Sample output from the incoming example data:

Note that the results are automatically sorted in descending order by count, showing the most frequently accessed pages first.

Your LogScale repository is ingesting log entries from a web server for a photography site. On this site there are several articles about photography. The URL for articles on this site ends with the extension, .page instead of .html.

You want to extract the page users viewed and then list the top most viewed pages.

The table displays the matches from the most viewed pages during the selected period to the least — limited to the top twelve.

In this example, the top() function is used to identify the most common URLs that are returning HTTP 404 (Not Found) errors.

Example incoming data might look like this:

The query is used to identify which URLs most frequently return 404 errors, helping to pinpoint broken links or missing resources on a website.

This query is useful, for example, to prioritize which broken links to fix first, identify outdated links in external references, or detect potential website structure issues after content migration.

Sample output from the incoming example data:

Note that the results are automatically sorted in descending order by count, showing the URLs with the most 404 errors first.

You want to get a list of URLs that users attempted to view, but the web server could not find them.

The results show a few attempts to access pages like wp-login.php and similar pages. These are attempts to log into WordPress, Drupal, and other content management systems. Since this particular web server does not use a CMS, these pages don't exist on the server and are indications of failed hacker attempts.