Common event contract
Fields that keep these queries reusable
- timestamp_utc, service, host, region, environment, and resource
- cpu_utilization_pct, memory_utilization_pct, disk_utilization_pct, and request_rate
- instance_type, replica_count, deployment, and capacity_limit
Definitions before SQL
Decisions the query cannot make for you
- 1Define sustained saturation over several complete buckets instead of alerting on a single spike.
- 2Keep units and utilization denominators consistent across resource types.
- 3Connect resource pressure to service demand before recommending more capacity.
Recommended sequence
Build detection first, then diagnosis
Analysis patterns
Make the result explain a decision
Pair demand with utilization
Plot request or job volume beside resource use so an infrastructure change can be separated from ordinary workload growth.
Find sustained pressure
Use complete time buckets and consecutive threshold breaches to distinguish capacity risk from short-lived bursts.
Compare deployment boundaries
Break saturation down by service, region, host class, or deployment to locate uneven load and rollout regressions.
Complete recipes
Copy the query, then validate the assumptions
Find Host and Container Resource Saturation
Rank infrastructure sources by sustained CPU, memory, and disk utilization while preserving sample volume.
Which infrastructure sources are persistently resource constrained?
See SQL and resultAdapt the event contract before the threshold
Keep the analysis pattern, but validate table names, field types, business definitions, time windows, and minimum-volume rules against your own events. Every published query is also planned and executed against an empty typed table with the pinned engine.