Auditing Query Examples :: Kloudfuse Docs

Auditing Query Examples

Audit Log Examples

Total event volume by action

Shows the overall breakdown of every event type recorded in the window. Use this as a starting point for any compliance review — it immediately shows which operations are most frequent and flags any unexpected action types.

source="kf-audit-log" | count by action
action _count
logged in 147
create 38
update 22
delete 11
add_user_to_group 9
create_token 6
authorization_failure 4
logged out 3
delete_token 2

All events by user

Answers "what has each user done?" — the primary view for user activity auditing. The combination of user_email and action gives a per-user summary of every operation type.

source="kf-audit-log" | count by user_email, action
user_email action _count
alice@example.com logged in 42
alice@example.com create 14
alice@example.com update 8
bob@example.com logged in 31
bob@example.com add_user_to_group 5
svc-automation@example.com create_token 6
svc-automation@example.com delete_token 2

All events for a specific user

Scopes the previous query to a single user for detailed review. Replace the email address as needed.

source="kf-audit-log" user_email="alice@example.com" | count by action, resource_type
action resource_type _count
logged in auth 42
create policy 9
create group 5
update user 8
delete policy 3

Mutations by resource type and action

Shows what kinds of resources have been changed and how — useful for understanding the scope of administrative activity.

source="kf-audit-log" | count by resource_type, action
resource_type action _count
auth logged in 147
user update 18
group create 7
group add_user_to_group 9
policy create 12
policy delete 4
service_account create_token 6
folder_mapping create 3

Successful versus failed operations

Comparing success and failure counts across action types quickly surfaces failed mutations that may indicate permission gaps or misconfigured API calls.

source="kf-audit-log" | count by status, action
status action _count
success logged in 143
success create 35
success update 20
failure logged in 4
failure authorization_failure 4
failure create 3

Authorization failures by user

Identifies users who are repeatedly hitting permission boundaries. A high count for a single user often indicates a misconfigured policy or an automation credential with insufficient permissions.

source="kf-audit-log" action="authorization_failure" | count by user_email
user_email _count
svc-pipeline@example.com 12
carol@example.com 3
bob@example.com 1

Group membership changes

Tracks all user additions and removals across groups. resource_name is the group; the user being added or removed appears in resource_id.

source="kf-audit-log" (action="add_user_to_group" OR action="remove_user_from_group") | count by user_email, resource_name, action
user_email resource_name action _count
alice@example.com platform-admins add_user_to_group 3
alice@example.com read-only remove_user_from_group 2
bob@example.com platform-admins add_user_to_group 1

Service account token issuance and revocation

Tracks when service account tokens are created or deleted, and which administrator performed the action.

source="kf-audit-log" resource_type="service_account" (action="create_token" OR action="delete_token") | count by user_email, resource_name, action
user_email resource_name action _count
alice@example.com svc-automation create_token 4
alice@example.com svc-pipeline create_token 2
bob@example.com svc-automation delete_token 1

Performance Log Examples

Query volume by user

The primary view for understanding who is driving platform load. Each row is a unique caller; rows with an empty user_email are alert evaluation or service-to-service calls.

source="kf-performance-log" | count by user_email
user_email _count
(empty — alert evaluation and internal calls) 212,727
analyst@example.com 19,341
alice@example.com 8,204
dashboard-svc@example.com 4,871
bob@example.com 1,285

Query volume by service

Shows the distribution of queries across query services. Use this to understand relative load across telemetry types.

source="kf-performance-log" | count by service_name
service_name _count
query-service 1,458,539
logs-query-service 169,997
events-query-service 10,431
trace-query-service 330
rum-query-service 231

Average query latency by user

Identifies users whose queries run slowest on average. High latency for a specific user often indicates broad time-range or high-cardinality queries.

source="kf-performance-log" | avg(duration_ms) by user_email
user_email _avg
analyst@example.com 4,231
alice@example.com 892
dashboard-svc@example.com 341
bob@example.com 218

Slow queries exceeding a latency threshold

Counts queries slower than a given threshold, grouped by service. Adjust the threshold to match your SLOs.

source="kf-performance-log" duration_ms > 5000 | count by service_name
service_name _count
query-service 1,847
logs-query-service 312
trace-query-service 28

p95 latency by service

The 95th-percentile duration captures tail latency without being skewed by outliers. Use this alongside averages to identify services where most queries are fast but a significant tail is slow.

source="kf-performance-log" | p95(duration_ms) by service_name
service_name _p95
trace-query-service 8,104
query-service 3,217
logs-query-service 1,893
events-query-service 644
rum-query-service 201

Query volume over time

Plots total query throughput across all services in hourly buckets. Use this to identify traffic spikes, alert evaluation storms, or the effect of dashboard load patterns.

source="kf-performance-log" | count by service_name | timeslice 1h