#type=humio #kind=metrics m1>0 name=/storage-(read|write)/ | timechart(name, function={groupby(#vhost, function=max(m1)) | sum(_max)})

#type = humio | #kind=metrics
| name = "bucket-storage-*"
| groupby([cluster,name],function=[min(value),max(value)]) | name=~replace("^bucket-storage-", with="")
| sort([cluster,name],order=ascending)

$humio/insights:ingestLatencyByHost()

#type=humio #kind=logs | loglevel=ERROR | regex("(?<exception>[\w\.]+Exception)", strict=false) | /ERROR[^-]+- (?<msg>[^:=]+)/ | desc:=format("%s | %s | %s",field=[class, msg, exception]) | groupby([desc], function=[count(), collect(#vhost, separator=" "), max(@timestamp)]) | ago_sec:=(now()-_max)/1000 | round(ago_sec) | replace("^(.{15}).*", with="$1\.\.\.", field=#vhost, as="hosts") | table([_count, ago_sec, hosts, desc], sortby=_count)

$humio/insights:slowWarningsInQueries()

#type=humio #kind=requests| status>=400 status<500 | timechart(status)

$humio/insights:searchQueue()

$humio/insights:globalSnapshotSize()

#type=humio #kind=activity category=ScheduledSearch severity="Warning" message="Problem firing action" | format(format="%s/%s", field=[dataspace, scheduledSearchName], as=ScheduledSearch) | timechart(ScheduledSearch, limit=30)

#type=humio #kind=metrics name=missing-cluster-nodes | timechart(function=max(value))

#type=humio #kind=logs loglevel=ERROR
| regex("(?<exception>[\w\.]+Exception)", strict=false)
| /ERROR[^-]+- (?<msg>[^:=]+)/
| desc:=format("%s | %s | %s",field=[class, msg, exception])
| timechart(desc, limit=8)

#type=humio #kind=metrics name=failed-http-checks
| timechart(#vhost, function=max(m1), limit=30)

#type=humio #kind=activity category=Alert message != "Problem invoking action" | severity=~in(values=["Warning", "Error"]) | format(format="%s/%s", field=[dataspace, alertName], as=Alert) | timechart(Alert, limit=30)

$humio/insights:globalTransactions()

#type=humio #kind=activity category=Fdr | severity=~in(values=["Warning", "Error"]) | format(format="%s/%s", field=[dataspace, fdrFeedName], as=FdrFeed) | timechart(FdrFeed, limit=30)

#type=humio #kind=logs class="c.h.c.ClusterManagement$" "missing segment" | timechart(#vhost, limit=30)

#type=humio #kind=logs class="c.h.c.ShutdownHook$" "server closed" | timechart(#vhost)

#type=humio #kind=requests | status>=500 | timechart(status)

#type=humio #kind=activity category=Alert severity="Warning" message="Problem invoking action" | format(format="%s/%s", field=[dataspace, alertName], as=Alert) | timechart(Alert, limit=30)

#type=humio #kind=activity category=ScheduledSearch message != "Problem firing action" | severity=~in(values=["Warning", "Error"]) | format(format="%s/%s", field=[dataspace, scheduledSearchName], as=ScheduledSearch) | timechart(ScheduledSearch, limit=30)

$humio/insights:cpuUsagePercent()

$humio/insights:ingestErrors()

$humio/insights:jvmHiccup()

#type=humio #kind=metrics name=failed-http-checks
| timechart(#vhost, function=max(m1), limit=30)

#type=humio #kind=nonsensitive name="cluster_versions" | timechart(version, function=count(#vhost, distinct=true))

#type=humio #kind=nonsensitive name=processstatus | timechart(#vhost, function=max(VmRSS), limit=30)

#type=humio #kind=metrics name=jvm-heap-usage-percent | timechart(#vhost, function=max(value, as=percent), limit=30)

#type=humio | timechart(#vhost, limit=30, unit="1/s")

#type=humio #kind=metrics name=secondary-disk-usage  | timechart(#vhost, function=max(value))

#type=humio  #kind=nonsensitive name=fdcount | timechart(#vhost, function=max(fdcount), limit=30)

$humio/insights:cpuLoad()

#type=humio  #kind=nonsensitive name=meminfo | used:=100*Cached/MemTotal | timechart(#vhost, function=max(used), limit=30)

#type=humio #kind=metrics name="direct-memory-allocated" | timechart(#vhost, function=max(value),limit=30)

#type=humio #kind=metrics name=jvm-heap-usage | timechart(#vhost, function=max(value, as=bytes), limit=30)

#type=humio #kind=logs class="c.h.c.ShutdownHook$" "server closed" | timechart(#vhost, limit=30)

#type=humio #kind=nonsensitive name="cluster_versions"
| groupby(version, function=count(#vhost, distinct=true, as=nodes))
| table([nodes, version])

#type=humio #kind=nonsensitive name=lscpu |
groupby(#vhost, function=selectLast([cpus, onlineCpus, modelName, numaNodes, threadsPerCore, virtualizationType, sockent, hypervisorVendor, l1dCache, l1iCache, l2Cache, l3Cache]))
| sort(#host)

#type=humio #kind=metrics name=primary-disk-usage  | timechart(#vhost, function=max(value), limit=30)

#type=humio #kind=logs class=c.h.j.JVMStats "GC stats" | timechart(#vhost, function={groupby(name, function=counterAsRate(time_ms)) | sum(_rate)}, limit=30)

#type=humio  #kind=nonsensitive name=netdev | timechart(#vhost, function=
  {groupby(device,
    function={[
      min(rx_bytes, as=rx_min), max(rx_bytes, as=rx_max),
      min(tx_bytes, as=tx_min), max(tx_bytes, as=tx_max)]
    | rx:=rx_max - rx_min | tx:=tx_max - tx_min})
| [sum(rx, as=rx), sum(tx, as=tx)]}
, unit="1/s", limit=30)

#type=humio #kind=nonsensitive name="stat_tasks" | time:=(utime+stime) | timechart(threadGroup, function=avg(time, as=ticks), limit=30)

#type=humio #kind=metrics name=missing-cluster-nodes | timechart(function=max(value), limit=30)

$humio/insights:cpuUsagePercent()

#type=humio #kind=logs "Http reachability" me=*
| groupby([me, hostId])
| source:=rename(me) | target:=rename(hostId) | weight:=rename(_count)

#type=humio #kind=metrics name=cluster-time-skew | timechart(#vhost, function=max(value), limit=30)

#type=humio #kind=requests (uri=/api\/v1\/ingest\// or uri=/services\/collector/)
|uri match{
  /collector/ => kind:= "hec";
  /hec/ => kind:= "hec";
  /elastic-bulk/ => kind:="elastic_bulk";
  /logplex/ => kind:="logplex";
  /humio-structured/ => kind:="humio-structured";
  /humio-unstructured/ => kind:="humio-unstructured";
  /raw/ => kind:="raw";
  * => kind:=uri
}
| timechart(kind, unit="1/s")

$humio/insights:datasourcesHittingMaxAutoshards()

#type=humio #kind=requests (uri=/api\/v1\/ingest\// or uri=/services\/collector/) status>=400 | timechart(status, unit="1/s")

#type=humio #kind=metrics name=livequery-count
| timechart(#vhost, function=max(value))

$humio/insights:datasourcesAutoShardingTable()

#type=humio #kind=metrics name=/^ingest-bytes(\/[^\/]+)?\/(?<repo>.*)$/
| timechart(repo,
       function={ groupby(#vhost, function=avg(m5)) | sum(_avg)},
       limit=30, unit="bytes/sec to bytes/day")

#type=humio #kind=metrics name=digest-coordinator-changes | timechart(#vhost, function=max(m1))

#type=humio #kind=metrics name=/^ingest-parsing(\/[^\/]+)?\/(?<repo>[^\/]+)\/(?<parser>[^\/]+)$/
| groupby([repo, parser, #vhost], function=[avg(mean, as=timePerEvent), avg(m1, as=eventsPerSecond), {time:=m1 * mean| avg(time, as=time)}])
| groupby([repo, parser], function=[sum(time, as=timeInParserPerSecond), avg(timePerEvent, as=timePerEvent), sum(eventsPerSecond, as=eventsPerSecond)])
| parser:=format("%s/%s", field=[repo, parser])
| timeInParser:= format("%d", field=timeInParserPerSecond)
| timePerEvent:= format("%,.2f", field=timePerEvent)
| eventsPerSecond:= format("%,.2f", field=eventsPerSecond)
| table([parser, timeInParser, eventsPerSecond, timePerEvent], sortby=timeInParserPerSecond, limit=20)

$humio/insights:ingestPerHost()

$humio/insights:IngestPerHostEventsPerSecond()

#type=humio #kind=metrics (name=time-livequery or name = "time-digest")
| timechart(name, function={groupby(#vhost, function=max(value)) | sum(_max)})

$humio/insights:ingestErrors()

#type=humio #kind=metrics | /name=ingest-offset-lowest\/(?<partition>\d+)/  | timechart(partition,function=counterasrate(value), limit=50, span=1h)

#type=humio #kind=requests (uri=/api\/v1\/ingest\// or uri=/services\/collector/) | timechart(unit="1/s")

$humio/insights:ingestLatencyByHost()

#type=humio #kind=metrics name=kafka-request-events | timechart(#vhost, function=[counterAsRate(count, as=c), avg(mean, as=m)], limit=30) | "Events Per Second":=c*m | drop([c,m])

#type=humio #kind=metrics | name=/event-latency-partition\/(?<p>\d+)/  | timechart(p,function=[avg(max,as=max),avg(mean,as=mean)], limit=30) | max:=max/1000 | mean:=mean/1000

$humio/insights:cpuUsagePercent()

#type=humio #kind=metrics name=/^ingest-parsing(\/[^\/]+)?\/(?<parser>[^\/]+\/[^\/]+)$/
| time:= mean * m1
| timechart(function={groupby([#vhost, parser], function=avg(time)) | sum(_avg)}, limit=30)

$humio/insights:datasourcesChangingAutoShards()

#type=humio #kind=metrics | name=/^written-events(\/[^\/]+)?\/(?<repo>.*)$/
| timechart(repo, function={groupby(#vhost, function=avg(m5)) | sum(_avg)}, limit=30)

#type=humio class="c.h.c.ShutdownHook$" "server closed" | timechart(#vhost, limit=30)

$humio/insights:datasourcesPerRepo()

#type=humio #kind=requests (uri=/api\/v1\/ingest\// or uri=/services\/collector/)
| timechart(function=percentile(time))

#type=humio class=c.h.q.LivequeryMonitor "Ingest delay exceeds threshold, canceling stale livequeries" | timechart(#vhost, limit=30)

#type=humio #kind=requests (uri=/api\/v1\/ingest\// or uri=/services\/collector/)
| timechart(function=percentile(contentLength))

#type=humio #kind=logs class=c.h.j.KafkaStatusLoggerJob
| topic_num_out_of_sync_replicas > 0
| timechart(topic_name, function=count(topic_partition, distinct=true))

#type=humio #kind=logs class = c.h.j.KafkaStatusLoggerJob
| topic_num_out_of_sync_replicas > 0
| topic_name="humio-ingest"
| groupby([topic_name,topic_partition])
| count()

#type=humio #kind=metrics name=ingest-writer-uncompressed-bytes | timechart(#vhost, function=max(m1), limit=30)

#type=humio #kind=logs class=c.h.j.KafkaStatusLoggerJob
| groupby([topic_name, topic_partition], function=[collect(topic_leader), collect(topic_replicas), collect(topic_in_sync_replicas), collect(topic_is_in_sync)],limit=50)
| drop(@timestamp)
| table([topic_name, topic_partition, topic_is_in_sync, topic_leader, topic_replicas, topic_in_sync_replicas], sortby=[topic_is_in_sync, topic_name, topic_partition], order=ascending)

#type=humio #kind=metrics name=kafka-request-bytes | timechart(#vhost, function=max(p75), limit=30)

#type=humio #kind=metrics name=global-publish-wait-for-value | timechart(#vhost, function=max(p75), limit=30)

#type=humio #kind=logs class=c.h.j.KafkaStatusLoggerJob
| topic_num_out_of_sync_replicas > 0
| topic_name="transientChatter-events"
| groupby([topic_name,topic_partition])
| count()

#type=humio #kind=metrics name=/kafka-chatter-by-kind-bytes\/(?<kind>[^,]+)/ | timechart(kind, function={groupby(#vhost, function=avg(m1)) | sum(_avg)}, limit=30)

#type=humio #kind=metrics name=global-publish-wait-for-value | timechart(#vhost, function=avg(mean_rate), limit=30)

#type=humio #kind=logs class = c.h.j.KafkaStatusLoggerJob
| topic_num_out_of_sync_replicas > 0
| topic_name="global-events"
| groupby([topic_name,topic_partition])
| count()

#type=humio #kind=metrics name=kafka-ingestqueue-put | timechart(#vhost, function=max(m1), limit=30, unit="1/s")

#type=humio #kind=metrics name=kafka-chatter-bytes | timechart(#vhost, function=avg(m1), limit=30)

#type=humio #kind=metrics name=kafka-chatter-put | timechart(#vhost, function=avg(m1), limit=30)

$humio/insights:globalTransactions()

#type=humio "kafka-metrics ingest-consumer" | class=*IngestQueue* | timechart(partition, function=max("records-lag-max"), limit=24)

#type=humio #kind=metrics name=kafka-ingestqueue-put | timechart(#vhost, function=max(p75), limit=30)

$humio/insights:ingestPerHost()

$humio/insights:IngestPerHostEventsPerSecond()

$humio/insights:searchQueue()

#type=humio #kind=logs | loglevel=ERROR
| regex("(?<exception>[\w\.]+Exception)", strict=false)
| /ERROR[^-]+- (?<msg>[^:=]+)/
| desc:=format("%s | %s | %s",field=[class, msg, exception])
| groupby([desc], function=[count(), collect(#vhost), max(@timestamp)])
| ago_sec:=(now()-_max)/1000 | round(ago_sec)
| table([_count, ago_sec, desc, #vhost], sortby=_count)

#type=humio #kind=requests | timechart(#vhost, unit="1/s")

$humio/insights:ingestLatencyByHost()

$humio/insights:cpuUsagePercent()

$humio/insights:ingestErrors()

#type=humio #kind=logs loglevel=ERROR
| regex("(?<exception>[\w\.]+Exception)", strict=false)
| /ERROR[^-]+- (?<msg>[^:=]+)/
| desc:=format("%s | %s | %s",field=[class, msg, exception])
| timechart(desc, limit=8)

$humio/insights:jvmHiccup()

#type=humio #kind=requests (uri=/api\/v1\/ingest\// or uri=/services\/collector/)
|uri match{
  /collector/ => kind:= "hec";
  /hec/ => kind:= "hec";
  /elastic-bulk/ => kind:="elastic_bulk";
  /logplex/ => kind:="logplex";
  /humio-structured/ => kind:="humio-structured";
  /humio-unstructured/ => kind:="humio-unstructured";
  /raw/ => kind:="raw";
  * => kind:=uri
}
| timechart(kind, unit="1/s")

#type=humio #kind=requests (uri=/api\/v1\/ingest\// or uri=/services\/collector/) | timechart(unit="1/s")

#type=humio #kind=requests | uri=/\/query$/ internal=false | timechart(#vhost, limit=30, unit="1/m")

#type=humio #kind=requests | uri=/\/query|queryjob/ internal=false | timechart(#vhost, limit=30, unit="1/s")

#type=humio #kind=requests | uri=/\/query|queryjob/ internal=true | timechart(#vhost, limit=30, unit="1/s")

#type=humio #kind=requests (uri=/api\/v1\/ingest\// or uri=/services\/collector/)
| timechart(function=percentile(time))

#type=humio #kind=requests | uri=/\/query\/?$|queryjobs\/?$/ method=POST internal=false | timechart(#vhost, limit=30, unit="1/m")

#type=humio #kind=requests (uri=/api\/v1\/ingest\// or uri=/services\/collector/)
| timechart(function=percentile(contentLength))

#type=humio #kind=requests status>=400 | timechart(status, unit="1/s")

#type=humio #kind=requests (uri=/api\/v1\/ingest\// or uri=/services\/collector/) status>=400 | timechart(status, unit="1/s")

#type=humio #kind=requests | uri=/\/(?<repo>[^\/]+)\/queryjobs$/ method=POST internal=false | timechart(repo, limit=30, unit="1/m")

#type=humio #kind=requests
| timechart(function=percentile(time, percentiles=[50, 90, 99, 100]))

#type=humio #kind=requests | timechart(unit="1/s")

#type=humio #kind=logs class="c.h.q.m.MapReduceQueryExecutor$"| "Starved searching" | timechart(#vhost, limit=30)

#type=humio #kind=logs class="c.h.s.e.InternalClusterQueryJobEndpoint$" "serializing large state" | timechart(function=max(size))

#type=humio #kind=requests | uri=/\/query|queryjob/ internal=false | timechart(#vhost, limit=30, unit="1/s")

#type=humio #kind=metrics name=queries
| timechart(#vhost, function=counterasrate(count), limit=30, unit="1/s to 1/m")
//| groupby(repo, function=avg(m1, as=q)) | sort(q)

$humio/insights:cpuUsagePercent()

#type=humio #kind=metrics name=query-delta-total-memory-allocation | timechart(function={groupby(#vhost, function=max(mean)) | sum(_max, as=mean)})

#type=humio #kind=logs class="c.h.s.e.InternalClusterQueryJobEndpoint$" "serializing large state"
| queryID =~ join({#type=humio #kind=logs class="c.h.q.QuerySessions$" "creating new query"}, mode=left, include=query)
| top([dataspace, queryID, query], max=size)
| _max:= (_max / (1024 * 1024)) | _max := format("%d", field=_max)//result in megabytes
| table([_max, dataspace, queryID, query])

#type=humio #kind=metrics name=load-segment-total |  timechart(#vhost, function=max(m1), limit=30)

#type=humio #kind=logs class=c.h.j.RunningQueriesLoggerJob "Highest Cost query"
| repoUser:= format("%s/%s", field=[dataspace, initiatingUser])
| top(repoUser, sum=deltaTotalCost, as=cost)
| table([cost, repoUser], sortby=cost)

$humio/insights:searchQueue()

#type=humio #kind=metrics name=/^query-millis(\/[^\/]+)?\/(?<repo>.*)$/ | timechart(function={groupby([repo, #vhost], function=max(m1)) | sum(_max)})

#type=humio #kind=logs class="c.h.q.QuerySessions$" "query was restarted" | timechart(reason)

#type=humio #kind=requests | uri=/\/(?<repo>[^\/]+)\/queryjobs$/ internal=false | timechart(repo, limit=30, unit="1/m")

#type=humio #kind=metrics name=local-query-segments-queue*
| timechart(name, function={groupby(#vhost, function=max(value)) | sum(_max)}, limit=30)

#type=humio #kind=metrics name=time-livequery | timechart(function={groupby(#vhost, function=max(value)) | sum(_max)})

#type=humio #kind=metrics name=read-compressed-bytes  metric_type=METER | timechart(#vhost, function=max(m1))

#type=humio #kind=nonsensitive name="stat_tasks" | time:=(utime+stime) | timechart(threadGroup, function=avg(time, as=ticks), limit=20)

$humio/insights:slowWarningsInQueries()

#type=humio #kind=metrics name=livequery-count | timechart(#vhost, function=max(value), limit=30)

#type=humio #kind=logs class=c.h.j.RunningQueriesLoggerJob "Highest Cost query"
| top(queryInput, sum=deltaTotalCost, as=cost)
| table([cost, queryInput], sortby=cost)

#type=humio #kind=logs | class = "c.h.q.QuerySessions$" "creating new query" | join({#type=humio #kind=threaddumps state=RUNNABLE  group=query | top(query)}, key=query, field=queryID, include=[_count]) | repository:= rename(dataspace) | table([_count, repository, queryID, query], sortby=_count)

#type=humio  #kind=threaddumps state=RUNNABLE group=query| timechart(query, limit=30)

#type=humio #kind=metrics name="query-static-delta-cpu-usage"
| timechart(function={groupby(#vhost, function=max(mean)) | sum(_max, as=mean)})

#type=humio #kind=requests | uri=/\/query\/?$|queryjobs\/?$/ method=POST internal=false | timechart(#vhost, limit=30, unit="1/m")

#type=humio #kind=requests | uri=/\/query$/ internal=false | timechart(#vhost, limit=30, unit="1/m")

#type=humio #kind=requests | uri=/\/(?<repo>[^\/]+)\/query$/ internal=false | timechart(repo, limit=30, unit="1/m")

#type=humio #kind=requests | uri=/\/query|queryjob/ internal=true | timechart(#vhost, limit=30, unit="1/s")

#type=humio #kind=metrics name="query-delta-total-cost"
| timechart(function={groupby(#vhost, function=max(mean)) | sum(_max, as=mean)})

#type=humio #kind=metrics name="query-live-delta-cpu-usage"
| timechart(function={groupby(#vhost, function=max(mean)) | sum(_max, as=mean)})

#type=humio #kind=metrics name=target-segment-compressed-size | median>0 | timechart(function=[avg(median, as=median), avg(p75, as=p75), avg(p95, as=p95)])

#type=humio #kind=metrics name=segment-merge-cpu-time | median > 0 | timechart(function=[avg(p75, as=p75), avg(median, as=median), avg(p95, as=p95)], limit=30)

#type=humio #kind=metrics name=segment-merge-cpu-time | timechart(#vhost, function=avg(m1), limit=30, unit="1/s to 1/hour")

#type=humio #kind=metrics name=segment-merge-cpu-time mean>0 | timechart(#vhost, function=[avg(m1, as=rate), avg(mean, as=average_time)], limit=30, unit="1/s to 1/hour") | time:= (average_time * rate / 1000000000) | drop([average_time, rate])

#type=humio #kind=metrics name=target-segment-blocks median>0 | timechart(function=[avg(median, as=median), avg(p75, as=p75), avg(p95, as=p95)])

$humio/insights:globalSnapshotSize()

#type=humio #kind=metrics | name=/^datasource-count(\/[^\/]+)?\/(?<repo>.*)$/ | value>0 | timechart(repo,function=max(value), limit=50)