# Additional examples

Here are some practical examples on how to use the Kloudfuse log searching query language, FuseQL.

## Count all logs

`count of``all logs``Everything``top``10` 5s

```fuseql
* | timeslice 5s | count by (_timeslice)
```

This analysis works well for the following use cases:

- **Activity Patterns**: Examining logs over a time range can help spot patterns in system usage, traffic, or performance.
- **Scaling Decisions**: Predicting when the system requires additional capacity based on log trends.
- **Impact of Changes or Deployments**: Analyzing logs generated at the time of deployment for unexpected issues.

## Count all fingerprints

`count of``all fingerprints``Everything``top``10` 30s

```fuseql
* | timeslice 30s | count_unique(fingerprint) by (_timeslice)
```

This analysis works well for the following use cases:

- **Identify Unexpected Usage Patterns**: Tracking the changes in user-related fingerprints.
- **Spot New Problems Early**: Monitoring sudden increases in different kinds of fingerprints.

## Count all logs grouped by level

`count of``all logs``core:level``top 10``30 s`

```fuseql
* | timeslice 30s | count by (_timeslice, level)
```

This analysis works well for the following use cases:

- **Spot Spikes in Errors or Warnings**: Detecting increases in logs classified as `ERROR` or `WARN`.
- **Monitor System Usage Trends**: Tracking general operational details through `INFO` logs.

## Count all fingerprints grouped by source

`count of``all fingerprints``Core:source``top``10``5s`

```fuseql
* | timeslice 5s | count_unique(fingerprint) be (_timeslice, source)
```

This analysis works well for:

- **Source-Level Diagnosis**: Understanding which parts of the system create specific log patterns.
- **Resource Allocation and Scaling**: Identifying bottlenecks or resource contention issues.

## Average of a duration or number facet

`avg of``@*:duration``Everything``top``10``5s`

```fuseql
* | timeslice 5s | avg(@duration:duration_seconds) by (_timeslice)
```

This analysis works well for the following use cases:

- **Identify Bottlenecks and Latency Trends**: Analyzing performance trends over time.
- **Estimate Resource Requirements**: Planning resources based on average durations.

## Error rate formula

```fuseql
Core:level="error"
```

This analysis works well for:

- **Failure Detection**: Identifying system component failures through spikes in error rates.
- **Trend Analysis**: Monitoring gradual increases in error rates over time.

## Anomaly on count of error logs

```fuseql
Core:level="error"
```

This analysis works well for:

- **Anomaly Detection**: Identifying sudden spikes in error logs that deviate from the norm.

## Outlier

```none
level="error" | timeslice 120s | count by (_timeslice, kube_namespace) | outlier (_count) by 120s, model=dbscan, eps=3
```

This analysis works well for:

- **Identify Poor Performance by Source**: Detecting outlier error logs across different components.

## Log math operator to scale down the Y-axis

This analysis works well for:

- **Compress wide ranges of values**: Making comparisons easier.
- **Reduce the impact of extreme outliers**: Highlighting subtle trends.