#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| timechart(dataspace, limit=50, function=count(field=fdrFeedName, distinct=true))

#category=FilterAlert #severity="Error" subCategory=Action dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName, actionName], function=[tail(1), count(as="No. of times failed")])
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "No. of times failed", "Last failed", "Last message", "Last suggestion", "Last exceptionMessage", "alertId"], sortby=["No. of times failed", "Repository/view","Alert name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert #severity="Error" subCategory=User dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=tail(1))
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("message", as="Message")
| rename("suggestion", as="Suggestion")
| table(["Repository/view", "Alert name", "Last failed", "Message", "Suggestion", "alertId"], sortby=["Repository/view", "Alert name"], order=[asc,asc], limit=1000)

#category=FilterAlert dataspace=?repository alertName=?alertName
| message="Alert triggered on event and invoked at least one action"
| timechart(alertName)

#category = Alert dataspace=?repository alertName=?alertName
| message="Query started"
| timeChart(alertName, limit=50)

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| groupby([dataspace, fdrFeedName], function=[tail(1), count(as="No. of problems"), count(field=streamId, distinct=true, as="restarts")])
| restarts := restarts - 1
| rename(@timestamp, as="Last problem at")
| rename("dataspace", as="Repository")
| rename("fdrFeedName", as="FDR feed name")
| rename("restarts", as="No. of restarts")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository", "FDR feed name", "No. of problems", "No. of restarts", "Last problem at", "Last message", "Last suggestion", "Last exceptionMessage"], sortby=["No. of problems", "Repository", "FDR feed name"], order=[desc,asc,asc], limit=1000)

#category = Alert message="Query started" dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=[ { selectLast([@timestamp, alertId]) }, count(as="No. of times restarted")])
| rename(@timestamp, as="Last restarted")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| table(["Repository/view", "Alert name", "No. of times restarted", "Last restarted", "alertId"], sortby=["No. of times restarted", "Repository/view", "Alert name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert message="Alert triggered on event and invoked at least one action" dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=[selectLast(["@timestamp", actionIds, alertId]), count(as="No. of times triggered")])
| rename(@timestamp, as="Last triggered")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("actionIds", as="Action ids")
| table(["Repository/view", "Alert name", "Action ids", "No. of times triggered", "Last triggered", "alertId"], sortby=["No. of times triggered", "Repository/view", "Alert name"], order=[desc,asc,asc], limit=1000)

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| timechart(dataspace, limit=50, function=count(field=fdrFeedName, distinct=true))

#category=FilterAlert #severity="Error" subCategory=Action dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName, actionName], function=[tail(1), count(as="No. of times failed")])
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository/view", "Alert name", "No. of times failed", "Last failed", "Last message", "Last suggestion", "Last exceptionMessage", "alertId"], sortby=["No. of times failed", "Repository/view","Alert name"], order=[desc,asc,asc], limit=1000)

#category="ScheduledReport" | message="Scheduled report lacked behind and had to be rescheduled" | dataspace=?{repository=*} scheduledReportName=?{scheduledReportName=*}
| groupby([dataspace, scheduledReportName], function=[tail(1), count(as="No. of times lagging behind")])
| rename(@timestamp, as="Last lagging behind")
| rename("dataspace", as="Repository/view")
| rename("scheduledReportName", as="Scheduled report name")
| table(["Repository/view", "Scheduled report name", "No. of times lagging behind", "Last lagging behind", "scheduledReportId"], sortby=["No. of times lagging behind", "Repository/view", "Scheduled report name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert #severity="Error" subCategory=User dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=tail(1))
| rename(@timestamp, as="Last failed")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("message", as="Message")
| rename("suggestion", as="Suggestion")
| table(["Repository/view", "Alert name", "Last failed", "Message", "Suggestion", "alertId"], sortby=["Repository/view", "Alert name"], order=[asc,asc], limit=1000)

#category=FilterAlert dataspace=?repository alertName=?alertName
| message="Alert triggered on event and invoked at least one action"
| timechart(alertName)

#category=Fdr | #severity =~ in(values=["Warning", "Error"]) | dataspace=?{repository=*} fdrFeedName=?{fdrFeedName=*}
| groupby([dataspace, fdrFeedName], function=[tail(1), count(as="No. of problems"), count(field=streamId, distinct=true, as="restarts")])
| restarts := restarts - 1
| rename(@timestamp, as="Last problem at")
| rename("dataspace", as="Repository")
| rename("fdrFeedName", as="FDR feed name")
| rename("restarts", as="No. of restarts")
| rename("suggestion", as="Last suggestion")
| rename("message", as="Last message")
| rename("exceptionMessage", as="Last exceptionMessage")
| table(["Repository", "FDR feed name", "No. of problems", "No. of restarts", "Last problem at", "Last message", "Last suggestion", "Last exceptionMessage"], sortby=["No. of problems", "Repository", "FDR feed name"], order=[desc,asc,asc], limit=1000)

#category=FilterAlert message="Alert triggered on event and invoked at least one action" dataspace=?{repository=*} alertName=?{alertName=*}
| groupby([dataspace, alertName], function=[selectLast(["@timestamp", actionIds, alertId]), count(as="No. of times triggered")])
| rename(@timestamp, as="Last triggered")
| rename("dataspace", as="Repository/view")
| rename("alertName", as="Alert name")
| rename("actionIds", as="Action ids")
| table(["Repository/view", "Alert name", "Action ids", "No. of times triggered", "Last triggered", "alertId"], sortby=["No. of times triggered", "Repository/view", "Alert name"], order=[desc,asc,asc], limit=1000)