

-- Select number of http error codes in the last hour
SELECT http_status, count(http_status) from http_requests
  WHERE time > -24hours
  GROUP BY http_status;
-- AGGREGATE_LOCKSTEP;

-- Select 90th percentile latency in the last day
SELECT percentile(latency, 90) from latency_metric WHERE time > -24hours;
-- SCAN_LOCKSTEP

-- SELECT error rate with two metrics and a 5 min window
SELECT
  time,
  ((delta(succesful_requests.count) / delta(errors.count)) * 100) as error_rate,
  FROM successful_requests, errors
  WHERE time > -24hours
  GROUP BY TIME_WINDOW(5 minutes);
-- AGGREGATE_TIME_WINDOW

-- SELECT top 10 slowest pages yesterday by 90th percentile latency
SELECT
  url, percentile(90, latency) as 90thpercentile_latency
  FROM request_log
  WHERE time > 24hours
  GROUP BY url
  ORDER BY 90thpercentile_latency DESC
-- SELECT all pages yesterday with a 90th percentile latency > 1000ms
SELECT
  url, percentile(90, latency) as 90thpercentile_latency
  FROM request_log
  WHERE time > 24hours
  GROUP BY url
  HAVING 90thpercentile_latency > 1000;

-- SELECT 90thpercentile page latency for three pages in 5 min windows
SELECT
  time, url, percentile(90, latency) as 90thpercentile_latency
  FROM request_log
  WHERE time > 24hours
  WHERE url IN ("/mypage1", "/mypage2", "/mypage3")
  GROUP BY TIME_WINDOW(5minutes), url;

-- COUNT number of events per time period
SELECT count(*) FROM metric GROUP BY TIME_WINDOW(5minutes);

-- SELECT holtwinters forecast for a metric value
SELECT real_value, holtwinters_forecast(real_value)
  FROM metric
  WHERE time > -24hours AND time < +24hours;




### More examples:

  -- error rate computed from joining the first derivates of two metrics over a
  -- moving 60 second window in the last hour
  SELECT
    "http error rate" as series,
    num_200.time as x,
    num_500.val / num_200.val as y
  FROM (
      SELECT time, delta(value) AS val
        FROM http_status_codes
        SINCE -60minutes UNTIL now
        WHERE status_code = 200
        GROUP BY TIMEWINDOW(time, 60, 10);
    ) AS num_200
  JOIN (
      SELECT time, delta(value) AS val
        FROM http_status_codes
        SINCE -60minutes UNTIL now
        WHERE status_code = 5200
        GROUP BY TIMEWINDOW(time, 60, 10);
    ) AS num_500
  ) ON num_200.time = num_500.time;



  -- error rate computed from joining the first derivates of two metrics over a
  -- moving 60 second window in the last hour
  SELECT
    "http error rate" as series,
    num_200.time as x,
    num_500.val / num_200.val as y
  FROM (
      SELECT time, delta(value) AS val
        FROM http_status_codes
        SINCE -60minutes UNTIL now
        WHERE status_code = 200
        GROUP BY TIMEWINDOW(time, 60, 10);
    ) AS num_200, (
      SELECT time, delta(value) AS val
        FROM http_status_codes
        SINCE -60minutes UNTIL now
        WHERE status_code = 5200
        GROUP BY TIMEWINDOW(time, 60, 10);
    ) AS num_500
  WHERE num_200.time = num_500.time;





-- insert distribution as map of $bucket -> $count pairs. expand each $bucket to
-- $count rows with value = $bucket on query
-- e.g. insert value {10:2, 100: 4, 250: 1}
-- select...
-- time, value
-- t0, 10
-- t0, 10
-- t0, 100
-- t0, 100
-- t0, 100
-- t0, 100
-- t0, 250


-- display the last hour of measurements
SELECT "mymetric" as series, time as x, value as y FROM mymetric,

-- display the moving average of our measurement over a moving 60s window
SELECT time as x, average(value) as FROM mymetric GROUP BY TIMEWINDOW(time 60, 10);


-- insert rationals/fractions (e.g. error rate)
-- allows proper aggregation over error rate:
-- display the aggregate error rate with a moving 60s window in the last hour
SELECT time as x, sum(numerator(value)) / sum(denominator(value)) as y
  FROM mymetric
  GROUP BY TIMEWINDOW(time, 60, 10)
  WHERE time > -60mins;

-- display the error rate per host with a moving 60s window in the last hour
SELECT time as x, sum(numerator(value)) / sum(denominator(value)) as y
  FROM mymetric
  GROUP BY TIMEWINDOW(time, 60, 10), hostname
  WHERE time > -60mins;

-- display the first derivative of our measurement over a moving 60s window in the last hour
SELECT time as x, delta(value) as y
  FROM mymetric
  GROUP BY TIMEWINDOW(time, 60, 10)
  WHERE time > -60mins;

-- ....equivalent to
SELECT time as x, delta(value) as y
  FROM mymetric
  GROUP BY TIMEWINDOW(time, 60, 10)
  SINCE -60mins UNTIL now;

-- number of requests per http status code over a moving 60 second window in
-- the last hour
SELECT status_code as series, time as x, delta(value) as y
  FROM http_status_codes
  GROUP BY TIMEWINDOW(time, 60, 10), status_code;

-- error rate computed from joining two metrics over a moving 60 second window
-- in the last hour
SELECT
  hostname as series,
  time as x,
  delta(error_metric.value) / delta(success_metric.value) as y
FROM
  success_metric,
  error_metric
WHERE
  time > -60minutes
GROUP BY
  TIMEWINDOW(time, 60, 10),
  hostname;




Another example:

Draw a few latency distributions for multiple loadtest experiments sourced from
multiple csv files. The csv files contain two columns "time" and "runtime" and
one line for each request in the load test. The "time" column contains the wall
clock time at which the request was issued and the "runtime" column contains the
runtime of the request.

We will draw a single line graph that plots requests per minute vs the 90th
percentile latency in that time window.

    IMPORT experiment1 FROM "experiment_1.csv";

    DRAW LINE CHART;

    SERIES "experiment1" FROM
      SELECT count(*) as qps, nth_percentile(runtime, 90) as latency
        FROM experiment1
        GROUP BY time_window(time, 1s);

Lets add another experiment as a second series in the chart:

    IMPORT experiment1 FROM "experiment_1.csv";
    IMPORT experiment2 FROM "experiment_2.csv";

    BEGIN LINES;

    CREATE SERIES WITH SELECT
      "experiment1" as title, count(*) as x, nth_percentile(runtime, 90) as y
      FROM experiment1
      GROUP BY time_window(time, 1s);

    SERIES "experiment2" FROM
      SELECT count(*) as qps, nth_percentile(runtime, 90) as latency
        FROM experiment2
        GROUP BY time_window(time, 1s);


To make that last query more interesting lets say we put all our test results
into a single file with an additional "experiment" columns and try to recreate
the same chart:

    -- load a csv file with per request logs from a load test
    IMPORT loadtests FROM "myfile.csv";

    -- draw a graph of qps vs 90thpercentile, one series for each experiment
    BEGIN CHART;

    DRAW LINES experiment FROM
      SELECT experiment, count(*) as qps, nth_percentile(runtime) as latency
        FROM loadtests
        GROUP BY experiment, time_window(time, 1s);

