Common event contract
Fields that keep these queries reusable
- timestamp_utc, service, host, region, environment, and resource
- cpu_utilization_pct, memory_utilization_pct, disk_utilization_pct, and request_rate
- instance_type, replica_count, deployment, and capacity_limit
Definitions before SQL
Decisions the query cannot make for you
- 1Define sustained saturation over several complete buckets instead of alerting on a single spike.
- 2Keep units and utilization denominators consistent across resource types.
- 3Connect resource pressure to service demand before recommending more capacity.
Recommended sequence
Build detection first, then diagnosis
Analysis patterns
Make the result explain a decision
Pair demand with utilization
Plot request or job volume beside resource use so an infrastructure change can be separated from ordinary workload growth.
Find sustained pressure
Use complete time buckets and consecutive threshold breaches to distinguish capacity risk from short-lived bursts.
Compare deployment boundaries
Break saturation down by service, region, host class, or deployment to locate uneven load and rollout regressions.
Complete recipes
Copy the query, then validate the assumptions
Find Host and Container Resource Saturation
Rank infrastructure sources by sustained CPU, memory, and disk utilization while preserving sample volume.
Which infrastructure sources are persistently resource constrained?
See SQL and resultFind Cache Misses and Stampede Risk
Compare hit rate, backend cost, and concurrent misses by bounded cache-key pattern.
Which cache-key patterns combine a poor hit rate with concurrent backend work?
See SQL and resultCalculate Incident Detection and Recovery Time
Calculate time to detect and time to recover from structured incident lifecycle events.
How long does each service take to detect and recover from incidents?
See SQL and resultFind Kubernetes Restarts by Workload
Rank Kubernetes workloads by container restart events, readiness failures, and observed cumulative restart count.
Which Kubernetes workloads are restarting and failing readiness checks?
See SQL and resultAdapt the event contract before the threshold
Keep the analysis pattern, but validate table names, field types, business definitions, time windows, and minimum-volume rules against your own events. Every published query is also planned and executed against an empty typed table with the pinned engine.