#category=~in(values=[Alert,AggregateAlert,FilterAlert]) | #severity=~in(values=[?severity]) | dataspace=?repository alertName=?alertName
| groupby(message, function=[tail(1), count(as="No. of times failed")])
| rename(#severity, as="Severity")
| rename(@timestamp, as="Last failed")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Message")
| rename("warnings", as="Last warnings")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Message", "Severity", "No. of times failed", "Last failed", "Last suggestion", "Last exceptionMessage", "Last warnings", "alertId", "#category"], sortby=[Severity,Message], order=[asc,asc])

#category=~in(values=[Alert,AggregateAlert,FilterAlert]) |  dataspace=?repository alertName=?alertName
| status=*
| message match {
    "Alert triggered and invoked at least one action and will be throttled"         => successfulPoll:="true";
    "Alert triggered on event and invoked at least one action"                      => successfulPoll:="true";
    "Alert found results, but no actions were invoked since the alert is throttled" => successfulPoll:="true";
    "Alert found no results and will not trigger"                                   => successfulPoll:="true";
    *                                                                               => *;
  }
| [{status=Failure | count(as=failureCount)}, {status=Success successfulPoll=true | count(as=successPollCount)}, {status=Success successfulPoll!=true | count(as=successCount)}]
| case {
    test(successPollCount>0) | aggStatus:="🟢";
    test(failureCount>0)     | aggStatus:="🔴";
    test(successCount>0)     | aggStatus:="🟢";
    *                        | aggStatus:="⚪";
  }
| select(aggStatus)

#category=~in(values=[Alert,AggregateAlert,FilterAlert]) | dataspace=?repository alertName=?alertName
| message=~in(values=["Alert triggered and invoked at least one action and will be throttled", "Alert triggered on event and invoked at least one action"])
| timechart(alertName)

#category=~in(values=[Alert,AggregateAlert,FilterAlert]) | dataspace=?repository alertName=?alertName
| status=*
| message match {
  "Alert triggered and invoked at least one action and will be throttled"         => successfulPoll:="true";
  "Alert triggered on event and invoked at least one action"                      => successfulPoll:="true";
  "Alert found results, but no actions were invoked since the alert is throttled" => successfulPoll:="true";
  "Alert found no results and will not trigger"                                   => successfulPoll:="true";
  *                                                                               => *;
}
| timeChart(span=1m, function={
    [
      {status=Failure                      | count(as=failureCount)},
      {status=Success successfulPoll=true  | count(as=successPollCount)},
      {status=Success successfulPoll!=true | count(as=successCount)}
    ]
  })
| case {
    test(successPollCount>0) | "Success":=1 | "Failure":=0 | "Not Running":=0;
    test(failureCount>0)     | "Success":=0 | "Failure":=1 | "Not Running":=0;
    test(successCount>0)     | "Success":=1 | "Failure":=0 | "Not Running":=0;
    *                        | "Success":=0 | "Failure":=0 | "Not Running":=1;
  }
| drop([failureCount, successPollCount, successCount])

#category=~in(values=[AggregateAlert,FilterAlert]) | dataspace=?repository alertName=?alertName
isLiveQuery=false
| timechart(alertName, limit=50, function=count(), span=10m)
| case {
    _count>0 | _count:=1;
    *        | *;
  }

#category=~in(values=[AggregateAlert,FilterAlert]) | dataspace=?repository alertName=?alertName
isLiveQuery=*
| [{isLiveQuery=true | count(as=liveCount)}, {isLiveQuery=false | count(as=historicCount)}]
| case {
    test(historicCount>0) | aggStatus:="🔴";
    test(liveCount>0)     | aggStatus:="🟢";
    *                     | aggStatus:="⚪";
  }
| select(aggStatus)

#category=~in(values=[?alertTypes]) | #severity=~in(values=[?severity]) | subCategory=~in(values=[?subCategory])| dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName, actionName], function=[tail(1), count(as="No. of times failed")])
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename(@timestamp, as="Last failed")
| rename("#severity", as="Last severity")
| rename("message", as="Last message")
| rename("suggestion", as="Last suggestion")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "No. of times failed", "Last failed", "Last severity", "Last message", "Last suggestion", "Last exceptionMessage", "alertId", "#category"], sortby=["No. of times failed", "Repository/view", "Alert name"], order=[desc,asc,asc], limit=1000)

#category=~in(values=[?alertTypes]) | dataspace=?{repository=*} alertName=?{alertName=*} isLiveQuery=false
| timechart(dataspace, limit=50, function=count(field=alertName, distinct=true), span=10m)

#category=~in(values=[?alertTypes]) | dataspace=?{repository=*} alertName=?{alertName=*} | message=~in(values=["Alert triggered and invoked at least one action and will be throttled", "Alert triggered on event and invoked at least one action"])
| groupby([dataspace, alertName], function=[selectLast(["@timestamp", actionIds, alertId]), count(as="No. of times triggered")])
| rename(@timestamp, as="Last triggered")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("actionIds", as="Action ids")
| table(["Repository/view", "Alert name", "Action ids", "No. of times triggered", "Last triggered", "alertId"], sortby=["No. of times triggered", "Repository/view", "Alert name"], order=[desc,asc,asc], limit=1000)

#category=~in(values=[?alertTypes]) | dataspace=?{repository=*} alertName=?{alertName=*} | message=~in(values=["Alert triggered and invoked at least one action and will be throttled", "Alert triggered on event and invoked at least one action"])
| timechart(dataspace, limit=50, function=count(field=alertName, distinct=true), span=10m)

#category=~in(values=[?alertTypes]) | dataspace=?{repository=*} alertName=?{alertName=*} isLiveQuery=false
| groupby([dataspace, alertName], function=tail(1))
| rename(@timestamp, as="Last lagging behind")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| table(["Repository/view", "Alert name", "Last lagging behind", "alertId"], sortby=["Last lagging behind", "Repository/view", "Alert name"], order=[desc,asc,asc], limit=1000)

#category=~in(values=[?alertTypes]) | #severity=~in(values=[?severity]) | subCategory=~in(values=[?subCategory])| dataspace=?{repository=*} alertName=?{alertName=*}
| timechart(dataspace, limit=50, function=count(field=alertName, distinct=true), span=10m)

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| timechart(dataspace, limit=50, function=count(field=fdrFeedName, distinct=true))

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| groupby([dataspace, fdrFeedName], function=[tail(1), count(as="No. of problems"), count(field=streamId, distinct=true, as="restarts")])
| restarts := restarts - 1
| rename(@timestamp, as="Last problem at")
| rename("dataspace", as="Repository")
| rename("fdrFeedName", as="FDR feed name")
| rename("restarts", as="No. of restarts")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository", "FDR feed name", "No. of problems", "No. of restarts", "Last problem at", "Last message", "Last suggestion", "Last exceptionMessage"], sortby=["No. of problems", "Repository", "FDR feed name"], order=[desc,asc,asc], limit=1000)

#category=Fdr | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*} | message="SQS message ignored because of an error, it will be retried later as long as it stays on the SQS queue" OR message="SQS message ingested and deleted" |
groupBy([dataspace, fdrFeedName, messageId], function=tail(1)) |
message="SQS message ignored because of an error, it will be retried later as long as it stays on the SQS queue" |
groupBy([dataspace, fdrFeedName]) |
rename("dataspace",as="Repository") |
rename("fdrFeedName",as="FDR feed name") |
rename("_count",as="No. of messages") |
table(["Repository", "FDR feed name", "No. of messages"])

#category=FilterAlert dataspace=?repository alertName=?alertName
isLiveQuery=false
| timechart(alertName, limit=50, function=count(), span=10m)
| case {
    _count>0 | _count:=1;
    *        | *;
}

#category=FilterAlert dataspace=?repository alertName=?alertName
isLiveQuery=*
| [{isLiveQuery=true | count(as=liveCount)}, {isLiveQuery=false | count(as=historicCount)}]
| case {
  test(historicCount>0) | aggStatus:="🔴";
  test(liveCount>0)     | aggStatus:="🟢";
  *                     | aggStatus:="⚪";
}
| select(aggStatus)

#category=FilterAlert #severity=Warning dataspace=?repository alertName=?alertName
| groupby(message, function=[tail(1), count(as="No. of times failed")])
| rename(@timestamp, as="Last failed")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Message")
| rename("warnings", as="Last warnings")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Message", "No. of times failed", "Last failed", "Last suggestion", "Last exceptionMessage", "Last warnings", "alertId", "#category"], sortby=Message, order=asc)

#category=FilterAlert dataspace=?repository alertName=?alertName
| message="Alert triggered on event and invoked at least one action"
| timechart(alertName)

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| groupby([dataspace, fdrFeedName], function=[tail(1), count(as="No. of problems"), count(field=streamId, distinct=true, as="restarts")])
| restarts := restarts - 1
| rename(@timestamp, as="Last problem at")
| rename("dataspace", as="Repository")
| rename("fdrFeedName", as="FDR feed name")
| rename("restarts", as="No. of restarts")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository", "FDR feed name", "No. of problems", "No. of restarts", "Last problem at", "Last message", "Last suggestion", "Last exceptionMessage"], sortby=["No. of problems", "Repository", "FDR feed name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert dataspace=?repository alertName=?alertName
| status=*
| case {
  test(message=="Alert triggered on event and invoked at least one action")                      | successfulPoll:="true";
  test(message=="Alert found results, but no actions were invoked since the alert is throttled") | successfulPoll:="true";
  test(message=="Alert found no results and will not trigger")                                   | successfulPoll:="true";
  *                                                                                              | *;
}
| [{status=Failure | count(as=failureCount)}, {status=Success successfulPoll=true | count(as=successPollCount)}, {status=Success successfulPoll!=true | count(as=successCount)}]
| case {
  test(successPollCount>0) | aggStatus:="🟢";
  test(failureCount>0)     | aggStatus:="🔴";
  test(successCount>0)     | aggStatus:="🟢";
  *                        | aggStatus:="⚪";
}
| select(aggStatus)

#category=FilterAlert dataspace=?repository alertName=?alertName
| status=*
| case {
    test(message=="Alert triggered on event and invoked at least one action")                      | successfulPoll:="true";
    test(message=="Alert found results, but no actions were invoked since the alert is throttled") | successfulPoll:="true";
    test(message=="Alert found no results and will not trigger")                                   | successfulPoll:="true";
    *                                                                                              | *;
}
| timeChart(span=1m, function={
    [
      {status=Failure                      | count(as=failureCount)},
      {status=Success successfulPoll=true  | count(as=successPollCount)},
      {status=Success successfulPoll!=true | count(as=successCount)}
    ]
  })
| case {
    test(successPollCount>0) | "Success":=1 | "Failure":=0 | "Not Running":=0;
    test(failureCount>0)     | "Success":=0 | "Failure":=1 | "Not Running":=0;
    test(successCount>0)     | "Success":=1 | "Failure":=0 | "Not Running":=0;
    *                        | "Success":=0 | "Failure":=0 | "Not Running":=1;
  }
| drop([failureCount, successPollCount, successCount])

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| timechart(dataspace, limit=50, function=count(field=fdrFeedName, distinct=true))

#category=FilterAlert #severity="Error" subCategory=Action dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName, actionName], function=[tail(1), count(as="No. of times failed")])
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "No. of times failed", "Last failed", "Last message", "Last suggestion", "Last exceptionMessage", "alertId", "#category"], sortby=["No. of times failed", "Repository/view","Alert name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert #severity="Error" subCategory=User dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=tail(1))
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("message", as="Message")
| rename("suggestion", as="Suggestion")
| table(["Repository/view", "Alert name", "Last failed", "Message", "Suggestion", "alertId", "#category"], sortby=["Repository/view", "Alert name"], order=[asc,asc], limit=1000)

#category=FilterAlert #severity="Error" subCategory=Alert dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName, actionName], function=[tail(1), count(as="No. of times failed")])
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("message", as="Last message")
| rename("warnings", as="Last warnings")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "No. of times failed", "Last failed", "Last message", "Last suggestion", "Last exceptionMessage", "alertId", "#category"], sortby=["No. of times failed", "Repository/view","Alert name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert #severity="Warning" subCategory=Action dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName, actionName], function=[tail(1), count(as="No. of times failed")])
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("actionName", as="Action name")
| rename("message", as="Last message")
| rename("warnings", as="Last warnings")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "Action name", "No. of times failed", "Last failed", "Last message", "Last suggestion", "Last exceptionMessage", "alertId", "#category"], sortby=["No. of times failed", "Repository/view","Alert name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert dataspace=?repository alertName=?alertName
| message="Alert triggered on event and invoked at least one action"
| timechart(alertName)

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| groupby([dataspace, fdrFeedName], function=[tail(1), count(as="No. of problems"), count(field=streamId, distinct=true, as="restarts")])
| restarts := restarts - 1
| rename(@timestamp, as="Last problem at")
| rename("dataspace", as="Repository")
| rename("fdrFeedName", as="FDR feed name")
| rename("restarts", as="No. of restarts")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository", "FDR feed name", "No. of problems", "No. of restarts", "Last problem at", "Last message", "Last suggestion", "Last exceptionMessage"], sortby=["No. of problems", "Repository", "FDR feed name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert isLiveQuery=false dataspace=?{repository=*} alertName=?{alertName=*}
| timechart(dataspace, limit=50, function=count(field=alertName, distinct=true), span=10m)

#category=FilterAlert isLiveQuery=false dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=tail(1))
| rename(@timestamp, as="Last lagging behind")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| table(["Repository/view", "Alert name", "Last lagging behind", "alertId"], sortby=["Last lagging behind", "Repository/view", "Alert name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert #severity="Warning" dataspace=?{repository=*} alertName=?{alertName=*}
| timechart(dataspace, limit=50, function=count(field=alertName, distinct=true), span=10m)

#category=FilterAlert message="Alert triggered on event and invoked at least one action" dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=[selectLast(["@timestamp", actionIds, alertId]), count(as="No. of times triggered")])
| rename(@timestamp, as="Last triggered")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("actionIds", as="Action ids")
| table(["Repository/view", "Alert name", "Action ids", "No. of times triggered", "Last triggered", "alertId"], sortby=["No. of times triggered", "Repository/view", "Alert name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert #severity="Warning" subCategory=Query dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=[tail(1), count(as="No. of times failed")])
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("queryWarning", as="Last query warning")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "No. of times failed", "Last failed", "Last message", "Last suggestion", "Last exceptionMessage", "Last query warning", "alertId", "#category"], sortby=["No. of times failed", "Repository/view", "Alert name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert #severity="Error" subCategory=Query dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName, actionName], function=[tail(1), count(as="No. of times failed")])
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "No. of times failed", "Last failed", "Last message", "Last suggestion", "Last exceptionMessage", "alertId", "#category"], sortby=["No. of times failed", "Repository/view","Alert name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert dataspace=?repository alertName=?alertName
| message="Alert triggered on event and invoked at least one action"
| timechart(alertName)

#category = Alert dataspace=?repository alertName=?alertName
| message="Query started"
| timeChart(alertName, limit=50)

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| groupby([dataspace, fdrFeedName], function=[tail(1), count(as="No. of problems"), count(field=streamId, distinct=true, as="restarts")])
| restarts := restarts - 1
| rename(@timestamp, as="Last problem at")
| rename("dataspace", as="Repository")
| rename("fdrFeedName", as="FDR feed name")
| rename("restarts", as="No. of restarts")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository", "FDR feed name", "No. of problems", "No. of restarts", "Last problem at", "Last message", "Last suggestion", "Last exceptionMessage"], sortby=["No. of problems", "Repository", "FDR feed name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert dataspace=?repository alertName=?alertName
| status=*
| case {
  test(message=="Alert triggered on event and invoked at least one action")                      | successfulPoll:="true";
  test(message=="Alert found results, but no actions were invoked since the alert is throttled") | successfulPoll:="true";
  test(message=="Alert found no results and will not trigger")                                   | successfulPoll:="true";
  *                                                                                              | *;
}
| [{status=Failure | count(as=failureCount)}, {status=Success successfulPoll=true | count(as=successPollCount)}, {status=Success successfulPoll!=true | count(as=successCount)}]
| case {
  test(successPollCount>0) | aggStatus:="🟢";
  test(failureCount>0)     | aggStatus:="🔴";
  test(successCount>0)     | aggStatus:="🟢";
  *                        | aggStatus:="⚪";
}
| select(aggStatus)

#category=FilterAlert dataspace=?repository alertName=?alertName
| status=*
| case {
    test(message=="Alert triggered on event and invoked at least one action")                      | successfulPoll:="true";
    test(message=="Alert found results, but no actions were invoked since the alert is throttled") | successfulPoll:="true";
    test(message=="Alert found no results and will not trigger")                                   | successfulPoll:="true";
    *                                                                                              | *;
}
| timeChart(span=1m, function={
    [
      {status=Failure                      | count(as=failureCount)},
      {status=Success successfulPoll=true  | count(as=successPollCount)},
      {status=Success successfulPoll!=true | count(as=successCount)}
    ]
  })
| case {
    test(successPollCount>0) | "Success":=1 | "Failure":=0 | "Not Running":=0;
    test(failureCount>0)     | "Success":=0 | "Failure":=1 | "Not Running":=0;
    test(successCount>0)     | "Success":=1 | "Failure":=0 | "Not Running":=0;
    *                        | "Success":=0 | "Failure":=0 | "Not Running":=1;
  }
| drop([failureCount, successPollCount, successCount])

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| timechart(dataspace, limit=50, function=count(field=fdrFeedName, distinct=true))

#category=FilterAlert #severity="Error" subCategory=Action dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName, actionName], function=[tail(1), count(as="No. of times failed")])
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "No. of times failed", "Last failed", "Last message", "Last suggestion", "Last exceptionMessage", "alertId", "#category"], sortby=["No. of times failed", "Repository/view","Alert name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert #severity="Error" subCategory=User dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=tail(1))
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("message", as="Message")
| rename("suggestion", as="Suggestion")
| table(["Repository/view", "Alert name", "Last failed", "Message", "Suggestion", "alertId", "#category"], sortby=["Repository/view", "Alert name"], order=[asc,asc], limit=1000)

#category=FilterAlert dataspace=?repository alertName=?alertName
| message="Alert triggered on event and invoked at least one action"
| timechart(alertName)

#category = Alert dataspace=?repository alertName=?alertName
| message="Query started"
| timeChart(alertName, limit=50)

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| groupby([dataspace, fdrFeedName], function=[tail(1), count(as="No. of problems"), count(field=streamId, distinct=true, as="restarts")])
| restarts := restarts - 1
| rename(@timestamp, as="Last problem at")
| rename("dataspace", as="Repository")
| rename("fdrFeedName", as="FDR feed name")
| rename("restarts", as="No. of restarts")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository", "FDR feed name", "No. of problems", "No. of restarts", "Last problem at", "Last message", "Last suggestion", "Last exceptionMessage"], sortby=["No. of problems", "Repository", "FDR feed name"], order=[desc,asc,asc], limit=1000)

#category = Alert message="Query started" dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=[ { selectLast([@timestamp, alertId]) }, count(as="No. of times restarted")])
| rename(@timestamp, as="Last restarted")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| table(["Repository/view", "Alert name", "No. of times restarted", "Last restarted", "alertId"], sortby=["No. of times restarted", "Repository/view", "Alert name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert message="Alert triggered on event and invoked at least one action" dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=[selectLast(["@timestamp", actionIds, alertId]), count(as="No. of times triggered")])
| rename(@timestamp, as="Last triggered")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("actionIds", as="Action ids")
| table(["Repository/view", "Alert name", "Action ids", "No. of times triggered", "Last triggered", "alertId"], sortby=["No. of times triggered", "Repository/view", "Alert name"], order=[desc,asc,asc], limit=1000)

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| timechart(dataspace, limit=50, function=count(field=fdrFeedName, distinct=true))

#category="ScheduledReport" | #severity = "Warning" | dataspace=?{repository=*} scheduledReportName=?{scheduledReportName=*} | subCategory="ScheduledReport"
| groupby([dataspace, scheduledReportName], function=[tail(1), count(as="No. of times failed")])
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("scheduledReportName", as="Scheduled report name")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("warnings", as="Last warnings")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Scheduled report name", "No. of times failed", "Last failed", "Last message", "Last suggestion", "Last exceptionMessage", "Last warnings", "scheduledReportId"], sortby=["No. of times failed", "Repository/view", "Scheduled report name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert #severity="Error" subCategory=Action dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName, actionName], function=[tail(1), count(as="No. of times failed")])
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "No. of times failed", "Last failed", "Last message", "Last suggestion", "Last exceptionMessage", "alertId", "#category"], sortby=["No. of times failed", "Repository/view","Alert name"], order=[desc,asc,asc], limit=1000)

#category="ScheduledReport" | message="Scheduled report lacked behind and had to be rescheduled" | dataspace=?{repository=*} scheduledReportName=?{scheduledReportName=*}
| groupby([dataspace, scheduledReportName], function=[tail(1), count(as="No. of times lagging behind")])
| rename(@timestamp, as="Last lagging behind")
| rename("dataspace", as="Repository/view")
| rename("scheduledReportName", as="Scheduled report name")
| table(["Repository/view", "Scheduled report name", "No. of times lagging behind", "Last lagging behind", "scheduledReportId"], sortby=["No. of times lagging behind", "Repository/view", "Scheduled report name"], order=[desc,asc,asc], limit=1000)

#category="ScheduledReport" #severity="Error" | dataspace=?{repository=*} scheduledReportName=?{scheduledReportName=*} | errors="*File too large to process*"
| groupby([dataspace, scheduledReportName]) | count()

#category=FilterAlert dataspace=?repository alertName=?alertName
| message="Alert triggered on event and invoked at least one action"
| timechart(alertName)

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| groupby([dataspace, fdrFeedName], function=[tail(1), count(as="No. of problems"), count(field=streamId, distinct=true, as="restarts")])
| restarts := restarts - 1
| rename(@timestamp, as="Last problem at")
| rename("dataspace", as="Repository")
| rename("fdrFeedName", as="FDR feed name")
| rename("restarts", as="No. of restarts")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository", "FDR feed name", "No. of problems", "No. of restarts", "Last problem at", "Last message", "Last suggestion", "Last exceptionMessage"], sortby=["No. of problems", "Repository", "FDR feed name"], order=[desc,asc,asc], limit=1000)

#category="ScheduledReport" | #severity = "Error" | dataspace=?{repository=*} scheduledReportName=?{scheduledReportName=*} | subCategory="ScheduledReport"
| groupby([dataspace, scheduledReportName], function=[tail(1), count(as="No. of times failed")])
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("scheduledReportName", as="Scheduled report name")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("warnings", as="Last warnings")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Scheduled report name", "No. of times failed", "Last failed", "Last message", "Last suggestion", "Last exceptionMessage", "Last warnings", "scheduledReportId"], sortby=["No. of times failed", "Repository/view", "Scheduled report name"], order=[desc,asc,asc], limit=1000)

#category="ScheduledReport" | dataspace=?{repository=*} scheduledReportName=?{scheduledReportName=*} | in(field="message", values=["Scheduled report successfully finished executing", "Scheduled report failed to finish executing. Report will be retried.", "Scheduled report failed to finish executing because of a configuration error. Report will be disabled!"]) | timeChart(function=percentile(field=generationExecutionTimeMs, percentiles=[75,90,99]), minSpan=10m)

#category=FilterAlert message="Alert triggered on event and invoked at least one action" dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=[selectLast(["@timestamp", actionIds, alertId]), count(as="No. of times triggered")])
| rename(@timestamp, as="Last triggered")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("actionIds", as="Action ids")
| table(["Repository/view", "Alert name", "Action ids", "No. of times triggered", "Last triggered", "alertId"], sortby=["No. of times triggered", "Repository/view", "Alert name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert dataspace=?repository alertName=?alertName
| message="Alert triggered on event and invoked at least one action"
| timechart(alertName)

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| groupby([dataspace, fdrFeedName], function=[tail(1), count(as="No. of problems"), count(field=streamId, distinct=true, as="restarts")])
| restarts := restarts - 1
| rename(@timestamp, as="Last problem at")
| rename("dataspace", as="Repository")
| rename("fdrFeedName", as="FDR feed name")
| rename("restarts", as="No. of restarts")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository", "FDR feed name", "No. of problems", "No. of restarts", "Last problem at", "Last message", "Last suggestion", "Last exceptionMessage"], sortby=["No. of problems", "Repository", "FDR feed name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert dataspace=?repository alertName=?alertName
| status=*
| case {
    test(message=="Alert triggered on event and invoked at least one action")                      | successfulPoll:="true";
    test(message=="Alert found results, but no actions were invoked since the alert is throttled") | successfulPoll:="true";
    test(message=="Alert found no results and will not trigger")                                   | successfulPoll:="true";
    *                                                                                              | *;
}
| timeChart(span=1m, function={
    [
      {status=Failure                      | count(as=failureCount)},
      {status=Success successfulPoll=true  | count(as=successPollCount)},
      {status=Success successfulPoll!=true | count(as=successCount)}
    ]
  })
| case {
    test(successPollCount>0) | "Success":=1 | "Failure":=0 | "Not Running":=0;
    test(failureCount>0)     | "Success":=0 | "Failure":=1 | "Not Running":=0;
    test(successCount>0)     | "Success":=1 | "Failure":=0 | "Not Running":=0;
    *                        | "Success":=0 | "Failure":=0 | "Not Running":=1;
  }
| drop([failureCount, successPollCount, successCount])

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| timechart(dataspace, limit=50, function=count(field=fdrFeedName, distinct=true))

#category=FilterAlert #severity="Error" subCategory=Action dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName, actionName], function=[tail(1), count(as="No. of times failed")])
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "No. of times failed", "Last failed", "Last message", "Last suggestion", "Last exceptionMessage", "alertId", "#category"], sortby=["No. of times failed", "Repository/view","Alert name"], order=[desc,asc,asc], limit=1000)

#category="ScheduledReport" | message="Scheduled report lacked behind and had to be rescheduled" | dataspace=?{repository=*} scheduledReportName=?{scheduledReportName=*}
| groupby([dataspace, scheduledReportName], function=[tail(1), count(as="No. of times lagging behind")])
| rename(@timestamp, as="Last lagging behind")
| rename("dataspace", as="Repository/view")
| rename("scheduledReportName", as="Scheduled report name")
| table(["Repository/view", "Scheduled report name", "No. of times lagging behind", "Last lagging behind", "scheduledReportId"], sortby=["No. of times lagging behind", "Repository/view", "Scheduled report name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert #severity="Error" subCategory=User dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=tail(1))
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("message", as="Message")
| rename("suggestion", as="Suggestion")
| table(["Repository/view", "Alert name", "Last failed", "Message", "Suggestion", "alertId", "#category"], sortby=["Repository/view", "Alert name"], order=[asc,asc], limit=1000)

#category=FilterAlert dataspace=?repository alertName=?alertName
| message="Alert triggered on event and invoked at least one action"
| timechart(alertName)

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| groupby([dataspace, fdrFeedName], function=[tail(1), count(as="No. of problems"), count(field=streamId, distinct=true, as="restarts")])
| restarts := restarts - 1
| rename(@timestamp, as="Last problem at")
| rename("dataspace", as="Repository")
| rename("fdrFeedName", as="FDR feed name")
| rename("restarts", as="No. of restarts")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository", "FDR feed name", "No. of problems", "No. of restarts", "Last problem at", "Last message", "Last suggestion", "Last exceptionMessage"], sortby=["No. of problems", "Repository", "FDR feed name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert message="Alert triggered on event and invoked at least one action" dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=[selectLast(["@timestamp", actionIds, alertId]), count(as="No. of times triggered")])
| rename(@timestamp, as="Last triggered")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("actionIds", as="Action ids")
| table(["Repository/view", "Alert name", "Action ids", "No. of times triggered", "Last triggered", "alertId"], sortby=["No. of times triggered", "Repository/view", "Alert name"], order=[desc,asc,asc], limit=1000)