#category=Alert | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} alertName=?{alertName=*}
| timechart(dataspace, limit=50, function=count(field=alertName, distinct=true), span=10m)

#category=Alert #severity = "Warning" message = "Problem invoking action" dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName, actionName], function=[tail(1), count(as="No. of times failed")])
| sort(["No. of times failed", "dataspace","alertName"], order=[desc,asc,asc])
| rename(@timestamp, as="Last failed") | formatTime(field="Last failed", format="%Y/%m/%d %H:%M:%S %Z", as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("actionName", as="Action name")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "Action name", "No. of times failed", "Last failed", "Last exceptionMessage"])

#category=Alert subCategory=User | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=tail(1))
| sort(["dataspace","alertName"], order=asc)
| rename(@timestamp, as="Last failed") | formatTime(field="Last failed", format="%Y/%m/%d %H:%M:%S %Z", as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("message", as="Message")
| rename("suggestion", as="Suggestion")
| table(["Repository/view", "Alert name", "Last failed", "Message", "Suggestion"])

#category=Alert | message="Alert triggered and invoked at least one action and will be throttled" dataspace=?{repository=*} alertName=?{alertName=*}
| timechart(dataspace, limit=50, function=count(field=alertName, distinct=true), span=10m)

#category = Alert message="Query started" dataspace=?{repository=*} alertName=?{alertName=*}
| dataspaceAlertName := format("%s: %s", field=[dataspace, alertName])
| timeChart(dataspaceAlertName, limit=50)

#category=Alert | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=[tail(1), count(as="No. of times failed")])
| subCategory != User message != "Problem invoking action"
| sort(["No. of times failed", "dataspace", "alertName"], order=[desc,asc,asc])
| rename(@timestamp, as="Last failed") | formatTime(field="Last failed", format="%Y/%m/%d %H:%M:%S %Z", as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("warnings", as="Last warnings")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "No. of times failed", "Last failed", "Last message", "Last suggestion", "Last exceptionMessage", "Last warnings"])

#category = Alert message="Query started" dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=[ { selectLast(@timestamp) }, count(as="No. of times started")])
| sort(["No. of times started", "dataspace", "alertName"], order=[desc,asc,asc])
| rename(@timestamp, as="Last started") | formatTime(field="Last started", format="%Y/%m/%d %H:%M:%S %Z", as="Last started")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| table(["Repository/view", "Alert name", "No. of times started", "Last started"])

#category=Alert message="Alert triggered and invoked at least one action and will be throttled" dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=[selectLast(["@timestamp", actionIds]), count(as="No. of times triggered")])
| sort(["No. of times triggered", "dataspace", "alertName"], order=[desc,asc,asc])
| rename(@timestamp, as="Last triggered") | formatTime(field="Last triggered", format="%Y/%m/%d %H:%M:%S %Z", as="Last triggered")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("actionIds", as="Action ids")
| table(["Repository/view", "Alert name", "Action ids", "No. of times triggered", "Last triggered"])

#category=Alert | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} alertName=?{alertName=*}
| timechart(dataspace, limit=50, function=count(field=alertName, distinct=true), span=10m)

#category=Alert | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=[tail(1), count(as="No. of times failed")])
| subCategory != User message != "Problem invoking action"
| sort(["No. of times failed", "dataspace", "alertName"], order=[desc,asc,asc])
| rename(@timestamp, as="Last failed") | formatTime(field="Last failed", format="%Y/%m/%d %H:%M:%S %Z", as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("warnings", as="Last warnings")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "No. of times failed", "Last failed", "Last message", "Last suggestion", "Last exceptionMessage", "Last warnings"])

#category=Fdr | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*} | message="SQS message ignored because of an error, it will be retried later as long as it stays on the SQS queue" OR message="SQS message ingested and deleted" |
groupBy([dataspace, fdrFeedName, messageId], function=tail(1)) |
message="SQS message ignored because of an error, it will be retried later as long as it stays on the SQS queue" |
groupBy([dataspace, fdrFeedName]) |
rename("dataspace",as="Repository") |
rename("fdrFeedName",as="FDR feed name") |
rename("_count",as="No. of messages") |
table(["Repository", "FDR feed name", "No. of messages"])

#category=Alert | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} alertName=?{alertName=*}
| timechart(dataspace, limit=50, function=count(field=alertName, distinct=true), span=10m)

#category=Alert #severity = "Warning" message = "Problem invoking action" dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName, actionName], function=[tail(1), count(as="No. of times failed")])
| sort(["No. of times failed", "dataspace","alertName"], order=[desc,asc,asc])
| rename(@timestamp, as="Last failed") | formatTime(field="Last failed", format="%Y/%m/%d %H:%M:%S %Z", as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("actionName", as="Action name")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "Action name", "No. of times failed", "Last failed", "Last exceptionMessage"])

#category=ScheduledSearch | message="Scheduled search lagged behind and had to be rescheduled" | dataspace=?{repository=*} scheduledSearchName=?{scheduledSearchName=*}
| groupby([dataspace, scheduledSearchName], function=[selectLast(@timestamp), count(as="No. of times lagging behind")])
| sort(["No. of times lagging behind", "dataspace", "scheduledSearchName"], order=[desc,asc,asc])
| rename(@timestamp, as="Last lagging behind") | formatTime(field="Last lagging behind", format="%Y/%m/%d %H:%M:%S %Z", as="Last lagging behind")
| rename("dataspace", as="Repository/view")
| rename("scheduledSearchName", as="Scheduled search name")
| table(["Repository/view", "Scheduled search name", "No. of times lagging behind", "Last lagging behind"])

#category=Alert subCategory=User | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=tail(1))
| sort(["dataspace","alertName"], order=asc)
| rename(@timestamp, as="Last failed") | formatTime(field="Last failed", format="%Y/%m/%d %H:%M:%S %Z", as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("message", as="Message")
| rename("suggestion", as="Suggestion")
| table(["Repository/view", "Alert name", "Last failed", "Message", "Suggestion"])

#category=Alert | message="Alert triggered and invoked at least one action and will be throttled" dataspace=?{repository=*} alertName=?{alertName=*}
| timechart(dataspace, limit=50, function=count(field=alertName, distinct=true), span=10m)

#category=Alert | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=[tail(1), count(as="No. of times failed")])
| subCategory != User message != "Problem invoking action"
| sort(["No. of times failed", "dataspace", "alertName"], order=[desc,asc,asc])
| rename(@timestamp, as="Last failed") | formatTime(field="Last failed", format="%Y/%m/%d %H:%M:%S %Z", as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("warnings", as="Last warnings")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "No. of times failed", "Last failed", "Last message", "Last suggestion", "Last exceptionMessage", "Last warnings"])

#category=Alert message="Alert triggered and invoked at least one action and will be throttled" dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=[selectLast(["@timestamp", actionIds]), count(as="No. of times triggered")])
| sort(["No. of times triggered", "dataspace", "alertName"], order=[desc,asc,asc])
| rename(@timestamp, as="Last triggered") | formatTime(field="Last triggered", format="%Y/%m/%d %H:%M:%S %Z", as="Last triggered")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("actionIds", as="Action ids")
| table(["Repository/view", "Alert name", "Action ids", "No. of times triggered", "Last triggered"])