# Additional examples

Here are some practical examples on how to use the Kloudfuse log searching query language, FuseQL.

## Count all logs

- Query Builder

- Advanced Search

`count of``all logs``Everything``top``10` 5s

```fuseql
* | timeslice 5s | count by (_timeslice)
```

This analysis works well for the following use cases:

- **Activity Patterns**: Analyzing logs over a time range can help spot patterns in system usage, traffic, or performance.
- **Scaling Decisions**: Predicting when the system requires additional capacity based on log patterns.
- **Impact of Changes or Deployments**: Analyzing logs after changes to ensure no unexpected issues arise.

## Count all fingerprints

- Query Builder

- Advanced Search

`count of``all fingerprints``Everything``top``10` 30s

```fuseql
* | timeslice 30s | count_unique(fingerprint) by (_timeslice)
```

This analysis works well for the following use cases:

- **Identify Unexpected Usage Patterns**: Tracking changes in user-related fingerprints over time.
- **Spot New Problems Early**: Identifying a sudden increase in the count of different kinds of fingerprints.

## Count all logs grouped by level

- Query Builder

- Advanced Search

`count of``all logs``core:level``top 10``30 s`

```fuseql
* | timeslice 30s | count by (_timeslice, level)
```

This analysis works well for the following use cases:

- **Spot Spikes in Errors or Warnings**: Monitoring logs by severity level to detect issues proactively.
- **Monitor System Usage Trends**: Analyzing system operational details through log levels.

## Count all fingerprints grouped by source

- Query Builder

- Advanced Search

`count of``al lfingerprints``Core:source``top``10``5s`

```fuseql
* | timeslice 5s | count_unique(fingerprint) by (_timeslice, source)
```

This analysis works well for the following use cases:

- **Source-Level Diagnosis**: Understanding log patterns by grouping them using their sources.
- **Resource Allocation and Scaling**: Targeting scaling or resource allocation based on log distribution.

## Average of a duration or number facet

- Query Builder

- Advanced Search

`avg of``@*:duration``Everything``top``10``5s`

```fuseql
* | timeslice 5s | avg(@duration:duration_seconds) by (_timeslice)
```

This analysis works well for the following use cases:

- **Identify Bottlenecks and Latency Trends**: Identifying performance trends over time.
- **Estimate Resource Requirements**: Planning for resource scaling based on average duration evaluations.

## Error rate formula

- FILTER a

- FILTER b

- FORMULA a/b

```fuseql
Core:level="error"
```

This analysis works well for the following use cases:

- **Failure Detection**: Identifying spikes in error rates to catch component failures or malfunctions.
- **Trend Analysis**: Monitoring gradual increases in error rates over time to detect potential issues.

## Anomaly on count of error logs

- Query Builder

- Advanced Search

```fuseql
Core:level="error"
```

This analysis works well for the following use case:

- **Anomaly Detection**: Detecting spikes in error log counts that deviate from expected ranges.

## Outlier

```none
level="error" | timeslice 120s | count by (_timeslice, kube_namespace) | outlier (_count) by 120s, model=dbscan, eps=3
```

This analysis works well for the following use case:

- **Identify Poor Performance by Source**: Monitoring error log rates by components to identify root causes for issues.