Search Examples

Expression	Definition
SQL Expression: `select * from OI_Prometheus_Build` EQL Expression: `USE OI_Prometheus_Build`	Displays results from an internal data model
SQL Expression: `select * from RT_BWCEHawkMicroagentKafkaBookStore_getActivityStats WHERE ([Activity Name] = 'SendProfitToBook')` EQL Expression:`USE RT_BWCEHawkMicroagentKafkaBookStore_getActivityStats \| ([Activity Name] = 'SendProfitToBook')`	Displays results from the Hawk Microagent Method data model `RT_BWCEHawkMicroagentKafkaBookStore_getActivityStats` with "Activity Name" as 'SendProfitToBook'
SQL Expression: `SELECT * FROM TS_go_memstats_alloc_bytes_total WHERE job LIKE '%NodeExport%' AND sys_eventTime in -1h` EQL Expression:`USE TS_go_memstats_alloc_bytes_total \| job LIKE '%NodeExport%' \| sys_eventTime in -1h`	Displays results from the time series metric `TS_go_memstats_alloc_bytes_total` where job is like ‘NodeExport’ in the last hour
SQL Expression: `SELECT activity_name, Count() FROM TS_hawk_bwce_getactivitystats_error_count WHERE sys_eventTime in -1h GROUP BY activity_name` EQL Expression:`USE TS_hawk_bwce_getactivitystats_error_count \| GROUP BY activity_name \| COLUMNS activity_name, Count() \| sys_eventTime in -1h`	Displays count of results from the time series metric `TS_hawk_bwce_getactivitystats_error_count` for each activity_name in the last hour
SQL Expression: `SELECT activity_name, avg_over_time(value,'1h') FROM TS_hawk_bwce_getactivitystats_error_count WHERE sys_eventTime in -2h` EQL Expression:`USE TS_hawk_bwce_getactivitystats_error_count \| COLUMNS activity_name, avg_over_time(value,'1h') \| sys_eventTime in -2h`	Displays average of results from the time series metric `TS_hawk_bwce_getactivitystats_error_count` for each hour interval in the last 2 hours
SQL Expression: `SELECT instance, job, TS_go_memstats_alloc_bytes_total.value + TS_go_memstats_heap_inuse_bytes.value AS CombinedValue FROM TS_go_memstats_alloc_bytes_total, TS_go_memstats_heap_inuse_bytes` EQL Expression:`USE TS_go_memstats_alloc_bytes_total, TS_go_memstats_heap_inuse_bytes \| COLUMNS instance, job, TS_go_memstats_alloc_bytes_total.value + TS_go_memstats_heap_inuse_bytes.value AS CombinedValue`	Displays results of all values from `TS_go_memstats_alloc_bytes_total` and `TS_go_memstats_heap_inuse_bytes` metrics with the value sumed from both the metric data model.

SQL Expression: select * from OI_Prometheus_Build

EQL Expression: USE OI_Prometheus_Build

Displays results from an internal data model

SQL Expression: select * from RT_BWCEHawkMicroagentKafkaBookStore_getActivityStats WHERE ([Activity Name] = 'SendProfitToBook')

EQL Expression:USE RT_BWCEHawkMicroagentKafkaBookStore_getActivityStats | ([Activity Name] = 'SendProfitToBook')

Displays results from the Hawk Microagent Method data model RT_BWCEHawkMicroagentKafkaBookStore_getActivityStats with "Activity Name" as 'SendProfitToBook'

SQL Expression: SELECT * FROM TS_go_memstats_alloc_bytes_total WHERE job LIKE '%NodeExport%' AND sys_eventTime in -1h

EQL Expression:USE TS_go_memstats_alloc_bytes_total | job LIKE '%NodeExport%' | sys_eventTime in -1h

Displays results from the time series metric TS_go_memstats_alloc_bytes_total where job is like ‘NodeExport’ in the last hour

SQL Expression:

SELECT  activity_name, Count(*) FROM  TS_hawk_bwce_getactivitystats_error_count WHERE sys_eventTime in -1h GROUP BY activity_name

EQL Expression:USE TS_hawk_bwce_getactivitystats_error_count | GROUP BY activity_name | COLUMNS activity_name, Count(*) | sys_eventTime in -1h

Displays count of results from the time series metric TS_hawk_bwce_getactivitystats_error_count for each activity_name in the last hour

SQL Expression:

SELECT  activity_name, avg_over_time(value,'1h')  FROM TS_hawk_bwce_getactivitystats_error_count  WHERE sys_eventTime in -2h

EQL Expression:USE TS_hawk_bwce_getactivitystats_error_count | COLUMNS activity_name, avg_over_time(value,'1h') | sys_eventTime in -2h

Displays average of results from the time series metric TS_hawk_bwce_getactivitystats_error_count for each hour interval in the last 2 hours

SQL Expression:

SELECT  instance, job, TS_go_memstats_alloc_bytes_total.value + TS_go_memstats_heap_inuse_bytes.value AS CombinedValue FROM TS_go_memstats_alloc_bytes_total, TS_go_memstats_heap_inuse_bytes

EQL Expression:USE TS_go_memstats_alloc_bytes_total, TS_go_memstats_heap_inuse_bytes | COLUMNS instance, job, TS_go_memstats_alloc_bytes_total.value + TS_go_memstats_heap_inuse_bytes.value AS CombinedValue

Displays results of all values from TS_go_memstats_alloc_bytes_total and TS_go_memstats_heap_inuse_bytes metrics with the value sumed from both the metric data model.