docker.container.status = "U*"|
groupby(["container.name","docker.container.status"])
|_count>1
|drop(_count)
|rename("container.name",as="container name")
|rename("docker.container.status",as="docker status")

groupby(docker.event.action)

groupby(["container.name","docker.container.ip_addresses[0]"],function=count(docker.container.ip_addresses[0],distinct=true))
|drop(_count)
|rename("container.name",as="container name")
|rename("docker.container.ip_addresses[0]",as="container ip address")

count(docker.image.tags[0],distinct=true)

total_bytes:=(docker.network.in.bytes+docker.network.out.bytes)
|timechart(container.name, function=max(total_bytes), limit=10)| unit:convert(_max, from=b, to=mb)|round(_max)|sort(_max, order=desc)

total_bytes:=(docker.network.in.errors+docker.network.inbound.errors+docker.network.out.errors+docker.network.outbound.errors)
|timeChart(function=max(total_bytes))

count(docker.info.containers.paused,distinct=true)

docker.cpu.total.pct:=(docker.cpu.total.pct*100)
|docker.memory.usage.pct:=(docker.memory.usage.pct*100)
|round(docker.cpu.total.pct)
|round(docker.memory.usage.pct)
|timechart(container.name, function=[avg(docker.cpu.total.pct, as=cpu_usage), avg(docker.memory.usage.pct, as=mem_usage)])

groupBy("container.image.name")
|count(container.image.name)

round(docker.diskio.read.bytes)
|round(docker.diskio.write.bytes)
|timechart(container.name, function=[avg(docker.diskio.read.bytes, as=diskread), avg(docker.diskio.write.bytes, as=diskwrite)])

count(docker.info.containers.stopped, distinct=true)

docker.cpu.total.pct:=(docker.cpu.total.pct*100)
|docker.memory.usage.pct:=(docker.memory.usage.pct*100)
|round(docker.cpu.total.pct)
|round(docker.memory.usage.pct)
|timechart(container.name, function=[avg(docker.cpu.total.pct, as=cpu_usage)])

docker.memory.stats.rss:=(docker.memory.stats.rss/1024)|round(docker.memory.stats.rss)|timechart("container.name", function=[avg(docker.memory.stats.rss, as=mem_rss_kbytes)])|unit:convert(mem_rss_kbytes, from=b, to=mb)