#type=humio | #kind=metrics | m1>0 | name=/storage-(read|write)/
| timechart(name, function={groupby(#vhost, function=max(m1)) | sum(_max)}, span=1m)

#kind=logs | #type=humio
| class=/BucketStorageDownloadExecutorSingle/
| /download[a-z ]+completed.+humiodata/
| case { reason = /IQ-(.+)/ | aggReason := "Query";
         * | aggReason := reason }
| timechart(aggReason, function=[sum(size)], limit=50)

#type = humio | #kind=metrics | "bucket-storage-download-requests-cap-size-hits"
| timechart(function=max(value), minSpan=1m)

#type=humio #kind=logs class="*QuerySessions*" "creating new query"
| join({#kind=logs | #type=humio | not "segment-modified" | class=/BucketStorageDownloadExecutorSingle/ /download[a-z ]+completed.+humiodata\.(?<segment>[^\s]+)/
    |   groupby(reason, function=[count(segment, distinct=true, as=segments), sum(size, as=size)])
       }, key=reason, field=queryID, include=[segments, size])
| sizeInGB:=size/(1024*1024*1024)
| table([dataspace, queryID, start, end, segments, sizeInGB], sortby=sizeInGB, limit=100)

#type = humio | #kind=metrics | "bucket-storage-download-queue-free-slots"
| timechart(function=min(value), minSpan=1m)

#type = humio | #kind=metrics
| name = "bucket-storage-*"
| groupby([cluster,name],function=[min(value),max(value)]) | name=~replace("^bucket-storage-", with="")
| sort([cluster,name],order=ascending)

#type = humio | #kind=metrics | "bucket-storage-upload-latency-max"
| timechart(function=max(value), minSpan=1m) | _max := _max / 1000

#type = humio | #kind=metrics | "bucket-storage-segment-downloads-in-progress"
| timechart(function=max(value), minSpan=1m)

#kind = "logs" | @rawstring = "*Mirrored from*" | to=* AND hostId=* | timeChart( function=[sum("fileSizeBytes", as="All Nodes")], span=12h)

#kind = "logs" | @rawstring = "*Mirrored from*" | to=* | timeChart(function=[sum("fileSizeBytes", as="All Nodes")], span=12h)

#kind = "logs" | @rawstring = "*Mirrored from bucket*" | to=* | timeChart(function=[sum("fileSizeBytes", as="All Nodes")], span=12h)

#kind = "logs" | @rawstring = "*Mirrored from bucket*" | to=* | timeChart(series=to, function=[sum("fileSizeBytes")], span=12h) | to := format(format="Node %s", field=[to])

#kind = "logs" | @rawstring = "*Mirrored from*" | to=* AND hostId =* | bucketConnection := format(format="From %s to %s", field=[hostId, to]) | timeChart(series=bucketConnection, function=[sum("fileSizeBytes")], span=12h)

$humio/insights:ingestLatencyByHost()

#type=humio #kind=logs | loglevel=ERROR | regex("(?<exception>[\w\.]+Exception)", strict=false) | /ERROR[^-]+- (?<msg>[^:=]+)/ | desc:=format("%s | %s | %s",field=[class, msg, exception]) | groupby([desc], function=[count(), collect(#vhost, separator=" "), max(@timestamp)]) | ago_sec:=(now()-_max)/1000 | round(ago_sec) | replace("^(.{15}).*", with="$1\.\.\.", field=#vhost, as="hosts") | table([_count, ago_sec, hosts, desc], sortby=_count)

$humio/insights:slowWarningsInQueries()

#kind!=* @rawstring="*fatal error*" _CMDLINE=*

#type=humio #kind=activity category=AggregateAlert message != "Problem invoking action. If all actions fail, they will be retried" | severity=~in(values=["Warning", "Error"]) | format(format="%s/%s", field=[dataspace, alertName], as=Alert) | timechart(Alert, limit=100)

#type=humio #kind=requests| status>=400 status<500 | timechart(status)

$humio/insights:searchQueue()

$humio/insights:globalSnapshotSize()

#type=humio #kind=activity category=ScheduledSearch severity="Warning" message="Problem firing action" | format(format="%s/%s", field=[dataspace, scheduledSearchName], as=ScheduledSearch) | timechart(ScheduledSearch, limit=100)

#type=humio #kind=metrics name=missing-cluster-nodes | timechart(function=max(value))

#type=humio #kind=activity category=AggregateAlert message="Problem invoking action. If all actions fail, they will be retried" | format(format="%s/%s", field=[dataspace, alertName], as=Alert) | timechart(Alert, limit=100)

#type=humio #kind=logs loglevel=ERROR
| regex("(?<exception>[\w\.]+Exception)", strict=false)
| /ERROR[^-]+- (?<msg>[^:=]+)/
| desc:=format("%s | %s | %s",field=[class, msg, exception])
| timechart(desc, limit=50)

#type=humio #kind=activity category=FilterAlert severity="Warning" message="Problem invoking action. If all actions fail, they will be retried" | format(format="%s/%s", field=[dataspace, alertName], as=Alert) | timechart(Alert, limit=100)

#type=humio #kind=metrics name=failed-http-checks
| timechart(#vhost, function=max(m1), limit=100, minSpan=1m)

#type=humio #kind=activity category=Alert message != "Problem invoking action" | severity=~in(values=["Warning", "Error"]) | format(format="%s/%s", field=[dataspace, alertName], as=Alert) | timechart(Alert, limit=100)

$humio/insights:globalTransactions()

#type=humio #kind=activity category=Fdr | severity=~in(values=["Warning", "Error"]) | format(format="%s/%s", field=[dataspace, fdrFeedName], as=FdrFeed) | timechart(FdrFeed, limit=100)

#type=humio #kind=logs class=/c\.h\.c\.ClusterManagement/ "missing segment" | timechart(#vhost, limit=100)

#type=humio #kind=logs class=/c\.h\.c\.ShutdownHook/ "server closed" | timechart(#vhost)

#type=humio #kind=requests | status>=500 | timechart(status)

#type=humio #kind=activity category=Alert severity="Warning" message="Problem invoking action" | format(format="%s/%s", field=[dataspace, alertName], as=Alert) | timechart(Alert, limit=100)

#type=humio #kind=activity category=ScheduledSearch message != "Problem firing action" | severity=~in(values=["Warning", "Error"]) | format(format="%s/%s", field=[dataspace, scheduledSearchName], as=ScheduledSearch) | timechart(ScheduledSearch, limit=100)

#type=humio #kind=activity category=FilterAlert message != "Problem invoking action. If all actions fail, they will be retried" | severity=~in(values=["Warning", "Error"]) | format(format="%s/%s", field=[dataspace, alertName], as=Alert) | timechart(Alert, limit=100)

$humio/insights:cpuUsagePercent()

$humio/insights:ingestErrors()

#type=humio ((#kind=nonsensitive name="cluster_versions") OR (#kind=logs "Http reachability" me=*))
| case {
  test(#vhost == host) | self_reported := "true";
  name="cluster_versions" | peer_reported := "true";
  "Http reachability" me=* | host := hostId | host_unreachable := "true"
}
| bucket(field=host, function=[
    {peer_reported = true | count(as=peer_reported_count)},
    {self_reported = true | count(as=self_reported_count)},
    {host_unreachable = true | count(as=host_unreachable_count)}
  ], limit=500, minSpan=5m)
| self_reported_count=0 peer_reported_count>0 host_unreachable_count=0
| @timestamp := _bucket | timechart(host, limit=100, minSpan=5m)

$humio/insights:jvmHiccup()

#type="humio" #kind="logs" @rawstring="*Http reachability check failed polling from*"
| timeChart(hostId, function={count(field=hostId, distinct=true)}, limit=50, minSpan=1m)

#type=humio #kind=nonsensitive name="cluster_versions" | timechart(version, function=count(host, distinct=true), limit=100, minSpan=1m)  // All nodes report version of all other nodes.

#type=humio #kind=nonsensitive name=processstatus | timechart(#vhost, function=max(VmRSS), limit=50, minSpan=1m)

#type=humio #kind=metrics name=jvm-heap-usage-percent | timechart(#vhost, function=max(value, as=percent), limit=50, minSpan=1m)

#type=humio | timechart(#vhost, limit=100, unit="1/s")

#type=humio #kind=metrics name=secondary-disk-usage  | timechart(#vhost, function=max(value), limit=100, minSpan=1m)

#type=humio  #kind=nonsensitive name=fdcount | timechart(#vhost, function=max(fdcount), limit=50, minSpan=1m)

// Chart mini segment disk usage as percentage of available space on local disk: (Humio v1.44+)
#type=humio #kind=logs class=/DiskSpaceJob/
| "Scanning localdatasource found these byte size totals locally"  OR "DiskSpaceJob: Status at start"
| timechart(#vhost, function=[max(miniBytes,as=minis),max(desiredUsedBytes,as=maxUse)], limit=50, minSpan=5m)
| minis:=100*minis/maxUse | drop(maxUse)

$humio/insights:cpuLoad()

#type=humio  #kind=nonsensitive name=meminfo | used:=100*Cached/MemTotal | timechart(#vhost, function=max(used), limit=50, minSpan=1m)

#type=humio #kind=metrics name="direct-memory-allocated" | timechart(#vhost, function=max(value),limit=100, minSpan=1m)

#type=humio #kind=metrics name=jvm-heap-usage | timechart(#vhost, function=max(value, as=bytes), limit=50, minSpan=1m)

#type=humio #kind=logs class=/c\.h\.c\.ShutdownHook/ "server closed" | timechart(#vhost, limit=100)

#type=humio #kind=nonsensitive name="cluster_versions"
| groupby(version, function=count(host, distinct=true, as=nodes))
| table([nodes, version]) // All nodes report version of all other nodes.

#type=humio #kind=nonsensitive name=lscpu |
groupby(#vhost, function=selectLast([cpus, onlineCpus, modelName, numaNodes, threadsPerCore, virtualizationType, sockent, hypervisorVendor, l1dCache, l1iCache, l2Cache, l3Cache]))
| sort(#host)

#type=humio #kind=metrics name=primary-disk-usage  | timechart(#vhost, function=max(value), limit=100, minSpan=1m)

#type=humio #kind=logs class=/\.JVMStats/ "GC stats" | timechart(#vhost, function={groupby(name, function=counterAsRate(time_ms)) | sum(_rate)}, limit=100, minSpan=1m)

#type=humio #kind=metrics | name = /thread-pool-queue-size\/(?<pool>[\s\S]*)/
| timeChart(pool, function=max(value), limit=50)

#type=humio  #kind=nonsensitive name=netdev | timechart(#vhost, function=
  {groupby(device,
    function={[
      min(rx_bytes, as=rx_min), max(rx_bytes, as=rx_max),
      min(tx_bytes, as=tx_min), max(tx_bytes, as=tx_max)]
    | rx:=rx_max - rx_min | tx:=tx_max - tx_min})
| [sum(rx, as=rx), sum(tx, as=tx)]}
, unit="1/s", limit=100, minSpan=1m)

#type=humio #kind=nonsensitive name="stat_tasks" | time:=(utime+stime) | timechart(threadGroup, function=avg(time, as=ticks), limit=100, minSpan=1m)

#type=humio #kind=metrics name="temp-disk-usage-bytes" | timechart(series=#vhost, function=max("value"), limit=50, minSpan=1m)

#type=humio #kind=metrics name=missing-cluster-nodes | timechart(function=max(value), limit=50, minSpan=1m)

$humio/insights:cpuUsagePercent()

#type=humio #kind=logs "Http reachability" me=*
| groupby([me, hostId])
| source:=rename(me) | target:=rename(hostId) | weight:=rename(_count)

#type=humio #kind=metrics name=cluster-time-skew | timechart(#vhost, function=max(value), limit=100, minSpan=1m)

#type=humio #kind=requests (uri=/api\/v1\/ingest\// or uri=/services\/collector/)
|uri match{
  /collector/ => kind:= "hec";
  /hec/ => kind:= "hec";
  /elastic-bulk/ => kind:="elastic_bulk";
  /logplex/ => kind:="logplex";
  /humio-structured/ => kind:="humio-structured";
  /humio-unstructured/ => kind:="humio-unstructured";
  /raw/ => kind:="raw";
  * => kind:=uri
}
| timechart(kind, unit="1/s")

$humio/insights:datasourcesHittingMaxAutoshards()

#type=humio #kind=requests (uri=/api\/v1\/ingest\// or uri=/services\/collector/) status>=400 | timechart(status, unit="1/s")

#type=humio #kind=metrics name=livequery-count
| timechart(#vhost, function=max(value), limit=100, minSpan=1m)

$humio/insights:datasourcesAutoShardingTable()

#type=humio #kind=metrics name=/^ingest-bytes(\/[^\/]+)?\/(?<repo>.*)$/
| timechart(repo,
       function={ groupby(#vhost, function=avg(m5)) | sum(_avg)},
       limit=100, minSpan=1m, unit="bytes/sec to bytes/day")

#type=humio #kind=logs class=c.h.c.c.IngestPartitionCoordinator "Wrote changes to current digest partitions" | changedAndAddedPartitions := changedPartitions + addedPartitions | timechart(#vhost, function=sum(changedAndAddedPartitions), limit=100, minSpan=1m)

#type=humio #kind=metrics name=/^ingest-parsing(\/[^\/]+)?\/(?<repo>[^\/]+)\/(?<parser>[^\/]+)$/
| parser:=format("%s/%s", field=[repo, parser])
| groupby([parser, #vhost], function=[avg(mean, as=timePerEvent), avg(m1, as=eventsPerSecond), {time:=m1 * mean| avg(time, as=time)}])
| groupby(parser, function=[sum(time, as=timeInParserPerSecond), avg(timePerEvent, as=timePerEvent), sum(eventsPerSecond, as=eventsPerSecond)])
| timeInParser:= format("%d", field=timeInParserPerSecond)
| timePerEvent:= format("%,.2f", field=timePerEvent)
| eventsPerSecond:= format("%,.2f", field=eventsPerSecond)
| table([parser, timeInParser, eventsPerSecond, timePerEvent], sortby=timeInParserPerSecond, limit=20)

$humio/insights:ingestPerHost()

$humio/insights:IngestPerHostEventsPerSecond()

#type=humio #kind=metrics (name=time-livequery or name = "time-digest")
| timechart(name, function={groupby(#vhost, function=max(value)) | sum(_max)}, limit=100, minSpan=1m)