[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-axiom-detect-anomalies":3,"mdc-ogopys-key":41,"related-org-axiom-detect-anomalies":1834,"related-repo-axiom-detect-anomalies":1999},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":36,"sourceUrl":39,"mdContent":40},"detect-anomalies","detect anomalies in observability data","Detect anomalies in Axiom datasets using statistical analysis. Use when looking for unusual patterns, volume spikes, outliers, or new error types in observability data.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"axiom","Axiom","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faxiom.png","axiomhq",[13,17,20,21],{"name":14,"slug":15,"type":16},"Observability","observability","tag",{"name":18,"slug":19,"type":16},"Monitoring","monitoring",{"name":9,"slug":8,"type":16},{"name":22,"slug":23,"type":16},"Data Analysis","data-analysis",58,"https:\u002F\u002Fgithub.com\u002Faxiomhq\u002Fcli","2026-04-06T18:04:19.681304",null,12,[8,30,31,32,33,34,35],"cli","command-line","command-line-tool","go","golang","hacktoberfest",{"repoUrl":25,"stars":24,"forks":28,"topics":37,"description":38},[8,30,31,32,33,34,35],"The power of Axiom on the command line.","https:\u002F\u002Fgithub.com\u002Faxiomhq\u002Fcli\u002Ftree\u002FHEAD\u002Fskills\u002Fdetect-anomalies","---\nname: detect-anomalies\ndescription: Detect anomalies in Axiom datasets using statistical analysis. Use when looking for unusual patterns, volume spikes, outliers, or new error types in observability data.\ncompatibility: Requires authenticated Axiom CLI (axiom)\nuser-invocable: true\ncontext: fork\nallowed-tools: Bash(axiom query *), Bash(axiom dataset list), Bash(axiom dataset list *), Bash(axiom config get *), Read, Grep, Glob\n---\n\n# Anomaly Detection\n\nDetect anomalies in Axiom datasets by comparing recent patterns to historical baselines using statistical analysis.\n\n## Arguments\n\nWhen invoked with a dataset name (e.g., `\u002Fdetect-anomalies logs`), it's available as `$ARGUMENTS`.\n\n## Prerequisites\n\nStatistical anomaly detection requires sufficient data:\n\n- **Minimum data points**: Z-score and standard deviation need ≥30 samples per bucket for statistical significance\n- **Historical baseline**: At least 24 hours of data for meaningful comparison (methods use 25h lookback)\n- **Consistent ingestion**: Gaps in data collection will skew baselines\n\nIf these aren't met, results may be misleading. Consider using simpler threshold-based alerting instead.\n\n## Schema Discovery\n\n**Always verify field names first:**\n\n```bash\naxiom query \"['\u003Cdataset>'] | getschema\" --start-time -1h\n```\n\n## Anomaly Detection Methods\n\n### 1. Volume Anomaly Detection\n\nCompare recent volume to baseline:\n\n**Calculate baseline (past 24h excluding last hour):**\n\n```bash\naxiom query \"['\u003Cdataset>']\n| where _time between (ago(25h) .. ago(1h))\n| summarize count() by bin(_time, 1h)\n| summarize\n    avg_hourly = avg(count_),\n    stdev_hourly = stdev(count_)\" --start-time -25h -f json\n```\n\n**Check recent volume:**\n\n```bash\naxiom query \"['\u003Cdataset>']\n| where _time >= ago(1h)\n| summarize\n    current_count = count(),\n    current_hour = min(_time)\" --start-time -1h -f json\n```\n\n**Z-score calculation:**\n- `z_score = (current - avg) \u002F stdev`\n- `|z_score| > 2` indicates anomaly\n\n### 2. New Value Detection\n\nFind values that appeared recently but weren't seen before:\n\n```bash\naxiom query \"['\u003Cdataset>']\n| where _time >= ago(1h)\n| summarize by error_code\n| join kind=leftanti (\n    ['\u003Cdataset>']\n    | where _time between (ago(25h) .. ago(1h))\n    | summarize by error_code\n  ) on error_code\" --start-time -25h -f json\n```\n\nReplace `error_code` with any categorical field (service, endpoint, status).\n\n### 3. Statistical Outliers\n\nFind values outside normal distribution:\n\n**Calculate bounds:**\n\n```bash\naxiom query \"['\u003Cdataset>']\n| where _time between (ago(25h) .. ago(1h))\n| summarize\n    avg_val = avg(duration),\n    stdev_val = stdev(duration)\n| extend\n    lower_bound = avg_val - 3 * stdev_val,\n    upper_bound = avg_val + 3 * stdev_val\" --start-time -25h -f json\n```\n\n**Find outliers:**\n\n```bash\naxiom query \"['\u003Cdataset>']\n| where _time >= ago(1h)\n| where duration \u003C \u003Clower_bound> or duration > \u003Cupper_bound>\n| limit 100\" --start-time -1h -f json\n```\n\n### 4. Rare Event Detection\n\nFind infrequent occurrences:\n\n```bash\naxiom query \"['\u003Cdataset>']\n| where _time >= ago(1h)\n| summarize count() by error_message\n| where count_ == 1\" --start-time -1h -f json\n```\n\n### 5. Error Rate Spike\n\nCompare error rate to baseline:\n\n```bash\naxiom query \"['\u003Cdataset>']\n| where _time >= ago(6h)\n| summarize\n    total = count(),\n    errors = countif(status >= 500)\n  by bin(_time, 15m)\n| extend error_rate = errors * 100.0 \u002F total\n| sort by _time asc\" --start-time -6h -f json\n```\n\n### 6. Latency Degradation\n\nTrack percentile changes:\n\n```bash\naxiom query \"['\u003Cdataset>']\n| where _time >= ago(6h)\n| summarize\n    p50 = percentile(duration, 50),\n    p95 = percentile(duration, 95),\n    p99 = percentile(duration, 99)\n  by bin(_time, 15m)\n| sort by _time asc\" --start-time -6h -f json\n```\n\n## Anomaly Categories\n\n| Type | Detection Method | Indicates |\n|------|------------------|-----------|\n| **Volume Spike** | Z-score on count | Traffic surge, attack, incident |\n| **Volume Drop** | Z-score on count | Outage, data collection issue |\n| **New Values** | Left anti-join | New errors, new services |\n| **Statistical Outlier** | 3-sigma rule | Extreme performance issue |\n| **Rare Events** | Count = 1 | Unusual conditions |\n| **Error Spike** | Error rate increase | Service degradation |\n| **Latency Spike** | Percentile increase | Performance issue |\n\n## Output Format\n\n```markdown\n## Anomaly Report: \u003Cdataset>\n\n### Summary\n- Analysis period: \u003Ctimeframe>\n- Anomalies found: \u003Ccount>\n\n### Volume Anomalies\n| Time | Count | Expected | Z-Score |\n|------|-------|----------|---------|\n| ... | ... | ... | ... |\n\n### New Values\n- Field: `error_code`\n- New values: `TIMEOUT_ERROR`, `CONNECTION_REFUSED`\n\n### Statistical Outliers\n- Field: `duration`\n- Outliers: \u003Ccount> events above \u003Cthreshold>\n\n### Error Rate\n- Baseline: X%\n- Current: Y%\n- Change: +Z%\n\n### Recommendations\n1. \u003CInvestigation action>\n2. \u003CMonitoring suggestion>\n```\n\n## Investigation Priority\n\n1. **Assess impact** - Is this affecting users?\n2. **Correlate timing** - What changed when anomaly started?\n3. **Check related systems** - Shared dependencies?\n4. **Verify data quality** - Is it a real issue or data problem?\n\n## When NOT to Use\n\n- **Insufficient data**: Z-score needs ≥30 data points; new datasets lack meaningful baselines\n- **Known thresholds**: If you have specific SLOs (e.g., \"p99 \u003C 500ms\"), use direct threshold queries\n- **Real-time alerting**: Use Axiom Monitors for continuous anomaly detection, not ad-hoc analysis\n- **Single data point**: Anomaly detection compares against distributions, not individual values\n\n## APL Reference\n\nFor query syntax, invoke the `axiom-apl` skill which provides anomaly detection patterns and function documentation.\n",{"data":42,"body":47},{"name":4,"description":6,"compatibility":43,"user-invocable":44,"context":45,"allowed-tools":46},"Requires authenticated Axiom CLI (axiom)",true,"fork","Bash(axiom query *), Bash(axiom dataset list), Bash(axiom dataset list *), Bash(axiom config get *), Read, Grep, Glob",{"type":48,"children":49},"root",[50,59,65,72,94,100,105,141,146,152,160,214,220,227,232,240,335,343,421,429,452,458,463,566,579,585,590,598,698,706,775,781,786,855,861,866,968,974,979,1077,1083,1262,1268,1710,1716,1760,1766,1809,1815,1828],{"type":51,"tag":52,"props":53,"children":55},"element","h1",{"id":54},"anomaly-detection",[56],{"type":57,"value":58},"text","Anomaly Detection",{"type":51,"tag":60,"props":61,"children":62},"p",{},[63],{"type":57,"value":64},"Detect anomalies in Axiom datasets by comparing recent patterns to historical baselines using statistical analysis.",{"type":51,"tag":66,"props":67,"children":69},"h2",{"id":68},"arguments",[70],{"type":57,"value":71},"Arguments",{"type":51,"tag":60,"props":73,"children":74},{},[75,77,84,86,92],{"type":57,"value":76},"When invoked with a dataset name (e.g., ",{"type":51,"tag":78,"props":79,"children":81},"code",{"className":80},[],[82],{"type":57,"value":83},"\u002Fdetect-anomalies logs",{"type":57,"value":85},"), it's available as ",{"type":51,"tag":78,"props":87,"children":89},{"className":88},[],[90],{"type":57,"value":91},"$ARGUMENTS",{"type":57,"value":93},".",{"type":51,"tag":66,"props":95,"children":97},{"id":96},"prerequisites",[98],{"type":57,"value":99},"Prerequisites",{"type":51,"tag":60,"props":101,"children":102},{},[103],{"type":57,"value":104},"Statistical anomaly detection requires sufficient data:",{"type":51,"tag":106,"props":107,"children":108},"ul",{},[109,121,131],{"type":51,"tag":110,"props":111,"children":112},"li",{},[113,119],{"type":51,"tag":114,"props":115,"children":116},"strong",{},[117],{"type":57,"value":118},"Minimum data points",{"type":57,"value":120},": Z-score and standard deviation need ≥30 samples per bucket for statistical significance",{"type":51,"tag":110,"props":122,"children":123},{},[124,129],{"type":51,"tag":114,"props":125,"children":126},{},[127],{"type":57,"value":128},"Historical baseline",{"type":57,"value":130},": At least 24 hours of data for meaningful comparison (methods use 25h lookback)",{"type":51,"tag":110,"props":132,"children":133},{},[134,139],{"type":51,"tag":114,"props":135,"children":136},{},[137],{"type":57,"value":138},"Consistent ingestion",{"type":57,"value":140},": Gaps in data collection will skew baselines",{"type":51,"tag":60,"props":142,"children":143},{},[144],{"type":57,"value":145},"If these aren't met, results may be misleading. Consider using simpler threshold-based alerting instead.",{"type":51,"tag":66,"props":147,"children":149},{"id":148},"schema-discovery",[150],{"type":57,"value":151},"Schema Discovery",{"type":51,"tag":60,"props":153,"children":154},{},[155],{"type":51,"tag":114,"props":156,"children":157},{},[158],{"type":57,"value":159},"Always verify field names first:",{"type":51,"tag":161,"props":162,"children":167},"pre",{"className":163,"code":164,"language":165,"meta":166,"style":166},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","axiom query \"['\u003Cdataset>'] | getschema\" --start-time -1h\n","bash","",[168],{"type":51,"tag":78,"props":169,"children":170},{"__ignoreMap":166},[171],{"type":51,"tag":172,"props":173,"children":176},"span",{"class":174,"line":175},"line",1,[177,182,188,194,199,204,209],{"type":51,"tag":172,"props":178,"children":180},{"style":179},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[181],{"type":57,"value":8},{"type":51,"tag":172,"props":183,"children":185},{"style":184},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[186],{"type":57,"value":187}," query",{"type":51,"tag":172,"props":189,"children":191},{"style":190},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[192],{"type":57,"value":193}," \"",{"type":51,"tag":172,"props":195,"children":196},{"style":184},[197],{"type":57,"value":198},"['\u003Cdataset>'] | getschema",{"type":51,"tag":172,"props":200,"children":201},{"style":190},[202],{"type":57,"value":203},"\"",{"type":51,"tag":172,"props":205,"children":206},{"style":184},[207],{"type":57,"value":208}," --start-time",{"type":51,"tag":172,"props":210,"children":211},{"style":184},[212],{"type":57,"value":213}," -1h\n",{"type":51,"tag":66,"props":215,"children":217},{"id":216},"anomaly-detection-methods",[218],{"type":57,"value":219},"Anomaly Detection Methods",{"type":51,"tag":221,"props":222,"children":224},"h3",{"id":223},"_1-volume-anomaly-detection",[225],{"type":57,"value":226},"1. Volume Anomaly Detection",{"type":51,"tag":60,"props":228,"children":229},{},[230],{"type":57,"value":231},"Compare recent volume to baseline:",{"type":51,"tag":60,"props":233,"children":234},{},[235],{"type":51,"tag":114,"props":236,"children":237},{},[238],{"type":57,"value":239},"Calculate baseline (past 24h excluding last hour):",{"type":51,"tag":161,"props":241,"children":243},{"className":163,"code":242,"language":165,"meta":166,"style":166},"axiom query \"['\u003Cdataset>']\n| where _time between (ago(25h) .. ago(1h))\n| summarize count() by bin(_time, 1h)\n| summarize\n    avg_hourly = avg(count_),\n    stdev_hourly = stdev(count_)\" --start-time -25h -f json\n",[244],{"type":51,"tag":78,"props":245,"children":246},{"__ignoreMap":166},[247,267,276,285,294,303],{"type":51,"tag":172,"props":248,"children":249},{"class":174,"line":175},[250,254,258,262],{"type":51,"tag":172,"props":251,"children":252},{"style":179},[253],{"type":57,"value":8},{"type":51,"tag":172,"props":255,"children":256},{"style":184},[257],{"type":57,"value":187},{"type":51,"tag":172,"props":259,"children":260},{"style":190},[261],{"type":57,"value":193},{"type":51,"tag":172,"props":263,"children":264},{"style":184},[265],{"type":57,"value":266},"['\u003Cdataset>']\n",{"type":51,"tag":172,"props":268,"children":270},{"class":174,"line":269},2,[271],{"type":51,"tag":172,"props":272,"children":273},{"style":184},[274],{"type":57,"value":275},"| where _time between (ago(25h) .. ago(1h))\n",{"type":51,"tag":172,"props":277,"children":279},{"class":174,"line":278},3,[280],{"type":51,"tag":172,"props":281,"children":282},{"style":184},[283],{"type":57,"value":284},"| summarize count() by bin(_time, 1h)\n",{"type":51,"tag":172,"props":286,"children":288},{"class":174,"line":287},4,[289],{"type":51,"tag":172,"props":290,"children":291},{"style":184},[292],{"type":57,"value":293},"| summarize\n",{"type":51,"tag":172,"props":295,"children":297},{"class":174,"line":296},5,[298],{"type":51,"tag":172,"props":299,"children":300},{"style":184},[301],{"type":57,"value":302},"    avg_hourly = avg(count_),\n",{"type":51,"tag":172,"props":304,"children":306},{"class":174,"line":305},6,[307,312,316,320,325,330],{"type":51,"tag":172,"props":308,"children":309},{"style":184},[310],{"type":57,"value":311},"    stdev_hourly = stdev(count_)",{"type":51,"tag":172,"props":313,"children":314},{"style":190},[315],{"type":57,"value":203},{"type":51,"tag":172,"props":317,"children":318},{"style":184},[319],{"type":57,"value":208},{"type":51,"tag":172,"props":321,"children":322},{"style":184},[323],{"type":57,"value":324}," -25h",{"type":51,"tag":172,"props":326,"children":327},{"style":184},[328],{"type":57,"value":329}," -f",{"type":51,"tag":172,"props":331,"children":332},{"style":184},[333],{"type":57,"value":334}," json\n",{"type":51,"tag":60,"props":336,"children":337},{},[338],{"type":51,"tag":114,"props":339,"children":340},{},[341],{"type":57,"value":342},"Check recent volume:",{"type":51,"tag":161,"props":344,"children":346},{"className":163,"code":345,"language":165,"meta":166,"style":166},"axiom query \"['\u003Cdataset>']\n| where _time >= ago(1h)\n| summarize\n    current_count = count(),\n    current_hour = min(_time)\" --start-time -1h -f json\n",[347],{"type":51,"tag":78,"props":348,"children":349},{"__ignoreMap":166},[350,369,377,384,392],{"type":51,"tag":172,"props":351,"children":352},{"class":174,"line":175},[353,357,361,365],{"type":51,"tag":172,"props":354,"children":355},{"style":179},[356],{"type":57,"value":8},{"type":51,"tag":172,"props":358,"children":359},{"style":184},[360],{"type":57,"value":187},{"type":51,"tag":172,"props":362,"children":363},{"style":190},[364],{"type":57,"value":193},{"type":51,"tag":172,"props":366,"children":367},{"style":184},[368],{"type":57,"value":266},{"type":51,"tag":172,"props":370,"children":371},{"class":174,"line":269},[372],{"type":51,"tag":172,"props":373,"children":374},{"style":184},[375],{"type":57,"value":376},"| where _time >= ago(1h)\n",{"type":51,"tag":172,"props":378,"children":379},{"class":174,"line":278},[380],{"type":51,"tag":172,"props":381,"children":382},{"style":184},[383],{"type":57,"value":293},{"type":51,"tag":172,"props":385,"children":386},{"class":174,"line":287},[387],{"type":51,"tag":172,"props":388,"children":389},{"style":184},[390],{"type":57,"value":391},"    current_count = count(),\n",{"type":51,"tag":172,"props":393,"children":394},{"class":174,"line":296},[395,400,404,408,413,417],{"type":51,"tag":172,"props":396,"children":397},{"style":184},[398],{"type":57,"value":399},"    current_hour = min(_time)",{"type":51,"tag":172,"props":401,"children":402},{"style":190},[403],{"type":57,"value":203},{"type":51,"tag":172,"props":405,"children":406},{"style":184},[407],{"type":57,"value":208},{"type":51,"tag":172,"props":409,"children":410},{"style":184},[411],{"type":57,"value":412}," -1h",{"type":51,"tag":172,"props":414,"children":415},{"style":184},[416],{"type":57,"value":329},{"type":51,"tag":172,"props":418,"children":419},{"style":184},[420],{"type":57,"value":334},{"type":51,"tag":60,"props":422,"children":423},{},[424],{"type":51,"tag":114,"props":425,"children":426},{},[427],{"type":57,"value":428},"Z-score calculation:",{"type":51,"tag":106,"props":430,"children":431},{},[432,441],{"type":51,"tag":110,"props":433,"children":434},{},[435],{"type":51,"tag":78,"props":436,"children":438},{"className":437},[],[439],{"type":57,"value":440},"z_score = (current - avg) \u002F stdev",{"type":51,"tag":110,"props":442,"children":443},{},[444,450],{"type":51,"tag":78,"props":445,"children":447},{"className":446},[],[448],{"type":57,"value":449},"|z_score| > 2",{"type":57,"value":451}," indicates anomaly",{"type":51,"tag":221,"props":453,"children":455},{"id":454},"_2-new-value-detection",[456],{"type":57,"value":457},"2. New Value Detection",{"type":51,"tag":60,"props":459,"children":460},{},[461],{"type":57,"value":462},"Find values that appeared recently but weren't seen before:",{"type":51,"tag":161,"props":464,"children":466},{"className":163,"code":465,"language":165,"meta":166,"style":166},"axiom query \"['\u003Cdataset>']\n| where _time >= ago(1h)\n| summarize by error_code\n| join kind=leftanti (\n    ['\u003Cdataset>']\n    | where _time between (ago(25h) .. ago(1h))\n    | summarize by error_code\n  ) on error_code\" --start-time -25h -f json\n",[467],{"type":51,"tag":78,"props":468,"children":469},{"__ignoreMap":166},[470,489,496,504,512,520,528,537],{"type":51,"tag":172,"props":471,"children":472},{"class":174,"line":175},[473,477,481,485],{"type":51,"tag":172,"props":474,"children":475},{"style":179},[476],{"type":57,"value":8},{"type":51,"tag":172,"props":478,"children":479},{"style":184},[480],{"type":57,"value":187},{"type":51,"tag":172,"props":482,"children":483},{"style":190},[484],{"type":57,"value":193},{"type":51,"tag":172,"props":486,"children":487},{"style":184},[488],{"type":57,"value":266},{"type":51,"tag":172,"props":490,"children":491},{"class":174,"line":269},[492],{"type":51,"tag":172,"props":493,"children":494},{"style":184},[495],{"type":57,"value":376},{"type":51,"tag":172,"props":497,"children":498},{"class":174,"line":278},[499],{"type":51,"tag":172,"props":500,"children":501},{"style":184},[502],{"type":57,"value":503},"| summarize by error_code\n",{"type":51,"tag":172,"props":505,"children":506},{"class":174,"line":287},[507],{"type":51,"tag":172,"props":508,"children":509},{"style":184},[510],{"type":57,"value":511},"| join kind=leftanti (\n",{"type":51,"tag":172,"props":513,"children":514},{"class":174,"line":296},[515],{"type":51,"tag":172,"props":516,"children":517},{"style":184},[518],{"type":57,"value":519},"    ['\u003Cdataset>']\n",{"type":51,"tag":172,"props":521,"children":522},{"class":174,"line":305},[523],{"type":51,"tag":172,"props":524,"children":525},{"style":184},[526],{"type":57,"value":527},"    | where _time between (ago(25h) .. ago(1h))\n",{"type":51,"tag":172,"props":529,"children":531},{"class":174,"line":530},7,[532],{"type":51,"tag":172,"props":533,"children":534},{"style":184},[535],{"type":57,"value":536},"    | summarize by error_code\n",{"type":51,"tag":172,"props":538,"children":540},{"class":174,"line":539},8,[541,546,550,554,558,562],{"type":51,"tag":172,"props":542,"children":543},{"style":184},[544],{"type":57,"value":545},"  ) on error_code",{"type":51,"tag":172,"props":547,"children":548},{"style":190},[549],{"type":57,"value":203},{"type":51,"tag":172,"props":551,"children":552},{"style":184},[553],{"type":57,"value":208},{"type":51,"tag":172,"props":555,"children":556},{"style":184},[557],{"type":57,"value":324},{"type":51,"tag":172,"props":559,"children":560},{"style":184},[561],{"type":57,"value":329},{"type":51,"tag":172,"props":563,"children":564},{"style":184},[565],{"type":57,"value":334},{"type":51,"tag":60,"props":567,"children":568},{},[569,571,577],{"type":57,"value":570},"Replace ",{"type":51,"tag":78,"props":572,"children":574},{"className":573},[],[575],{"type":57,"value":576},"error_code",{"type":57,"value":578}," with any categorical field (service, endpoint, status).",{"type":51,"tag":221,"props":580,"children":582},{"id":581},"_3-statistical-outliers",[583],{"type":57,"value":584},"3. Statistical Outliers",{"type":51,"tag":60,"props":586,"children":587},{},[588],{"type":57,"value":589},"Find values outside normal distribution:",{"type":51,"tag":60,"props":591,"children":592},{},[593],{"type":51,"tag":114,"props":594,"children":595},{},[596],{"type":57,"value":597},"Calculate bounds:",{"type":51,"tag":161,"props":599,"children":601},{"className":163,"code":600,"language":165,"meta":166,"style":166},"axiom query \"['\u003Cdataset>']\n| where _time between (ago(25h) .. ago(1h))\n| summarize\n    avg_val = avg(duration),\n    stdev_val = stdev(duration)\n| extend\n    lower_bound = avg_val - 3 * stdev_val,\n    upper_bound = avg_val + 3 * stdev_val\" --start-time -25h -f json\n",[602],{"type":51,"tag":78,"props":603,"children":604},{"__ignoreMap":166},[605,624,631,638,646,654,662,670],{"type":51,"tag":172,"props":606,"children":607},{"class":174,"line":175},[608,612,616,620],{"type":51,"tag":172,"props":609,"children":610},{"style":179},[611],{"type":57,"value":8},{"type":51,"tag":172,"props":613,"children":614},{"style":184},[615],{"type":57,"value":187},{"type":51,"tag":172,"props":617,"children":618},{"style":190},[619],{"type":57,"value":193},{"type":51,"tag":172,"props":621,"children":622},{"style":184},[623],{"type":57,"value":266},{"type":51,"tag":172,"props":625,"children":626},{"class":174,"line":269},[627],{"type":51,"tag":172,"props":628,"children":629},{"style":184},[630],{"type":57,"value":275},{"type":51,"tag":172,"props":632,"children":633},{"class":174,"line":278},[634],{"type":51,"tag":172,"props":635,"children":636},{"style":184},[637],{"type":57,"value":293},{"type":51,"tag":172,"props":639,"children":640},{"class":174,"line":287},[641],{"type":51,"tag":172,"props":642,"children":643},{"style":184},[644],{"type":57,"value":645},"    avg_val = avg(duration),\n",{"type":51,"tag":172,"props":647,"children":648},{"class":174,"line":296},[649],{"type":51,"tag":172,"props":650,"children":651},{"style":184},[652],{"type":57,"value":653},"    stdev_val = stdev(duration)\n",{"type":51,"tag":172,"props":655,"children":656},{"class":174,"line":305},[657],{"type":51,"tag":172,"props":658,"children":659},{"style":184},[660],{"type":57,"value":661},"| extend\n",{"type":51,"tag":172,"props":663,"children":664},{"class":174,"line":530},[665],{"type":51,"tag":172,"props":666,"children":667},{"style":184},[668],{"type":57,"value":669},"    lower_bound = avg_val - 3 * stdev_val,\n",{"type":51,"tag":172,"props":671,"children":672},{"class":174,"line":539},[673,678,682,686,690,694],{"type":51,"tag":172,"props":674,"children":675},{"style":184},[676],{"type":57,"value":677},"    upper_bound = avg_val + 3 * stdev_val",{"type":51,"tag":172,"props":679,"children":680},{"style":190},[681],{"type":57,"value":203},{"type":51,"tag":172,"props":683,"children":684},{"style":184},[685],{"type":57,"value":208},{"type":51,"tag":172,"props":687,"children":688},{"style":184},[689],{"type":57,"value":324},{"type":51,"tag":172,"props":691,"children":692},{"style":184},[693],{"type":57,"value":329},{"type":51,"tag":172,"props":695,"children":696},{"style":184},[697],{"type":57,"value":334},{"type":51,"tag":60,"props":699,"children":700},{},[701],{"type":51,"tag":114,"props":702,"children":703},{},[704],{"type":57,"value":705},"Find outliers:",{"type":51,"tag":161,"props":707,"children":709},{"className":163,"code":708,"language":165,"meta":166,"style":166},"axiom query \"['\u003Cdataset>']\n| where _time >= ago(1h)\n| where duration \u003C \u003Clower_bound> or duration > \u003Cupper_bound>\n| limit 100\" --start-time -1h -f json\n",[710],{"type":51,"tag":78,"props":711,"children":712},{"__ignoreMap":166},[713,732,739,747],{"type":51,"tag":172,"props":714,"children":715},{"class":174,"line":175},[716,720,724,728],{"type":51,"tag":172,"props":717,"children":718},{"style":179},[719],{"type":57,"value":8},{"type":51,"tag":172,"props":721,"children":722},{"style":184},[723],{"type":57,"value":187},{"type":51,"tag":172,"props":725,"children":726},{"style":190},[727],{"type":57,"value":193},{"type":51,"tag":172,"props":729,"children":730},{"style":184},[731],{"type":57,"value":266},{"type":51,"tag":172,"props":733,"children":734},{"class":174,"line":269},[735],{"type":51,"tag":172,"props":736,"children":737},{"style":184},[738],{"type":57,"value":376},{"type":51,"tag":172,"props":740,"children":741},{"class":174,"line":278},[742],{"type":51,"tag":172,"props":743,"children":744},{"style":184},[745],{"type":57,"value":746},"| where duration \u003C \u003Clower_bound> or duration > \u003Cupper_bound>\n",{"type":51,"tag":172,"props":748,"children":749},{"class":174,"line":287},[750,755,759,763,767,771],{"type":51,"tag":172,"props":751,"children":752},{"style":184},[753],{"type":57,"value":754},"| limit 100",{"type":51,"tag":172,"props":756,"children":757},{"style":190},[758],{"type":57,"value":203},{"type":51,"tag":172,"props":760,"children":761},{"style":184},[762],{"type":57,"value":208},{"type":51,"tag":172,"props":764,"children":765},{"style":184},[766],{"type":57,"value":412},{"type":51,"tag":172,"props":768,"children":769},{"style":184},[770],{"type":57,"value":329},{"type":51,"tag":172,"props":772,"children":773},{"style":184},[774],{"type":57,"value":334},{"type":51,"tag":221,"props":776,"children":778},{"id":777},"_4-rare-event-detection",[779],{"type":57,"value":780},"4. Rare Event Detection",{"type":51,"tag":60,"props":782,"children":783},{},[784],{"type":57,"value":785},"Find infrequent occurrences:",{"type":51,"tag":161,"props":787,"children":789},{"className":163,"code":788,"language":165,"meta":166,"style":166},"axiom query \"['\u003Cdataset>']\n| where _time >= ago(1h)\n| summarize count() by error_message\n| where count_ == 1\" --start-time -1h -f json\n",[790],{"type":51,"tag":78,"props":791,"children":792},{"__ignoreMap":166},[793,812,819,827],{"type":51,"tag":172,"props":794,"children":795},{"class":174,"line":175},[796,800,804,808],{"type":51,"tag":172,"props":797,"children":798},{"style":179},[799],{"type":57,"value":8},{"type":51,"tag":172,"props":801,"children":802},{"style":184},[803],{"type":57,"value":187},{"type":51,"tag":172,"props":805,"children":806},{"style":190},[807],{"type":57,"value":193},{"type":51,"tag":172,"props":809,"children":810},{"style":184},[811],{"type":57,"value":266},{"type":51,"tag":172,"props":813,"children":814},{"class":174,"line":269},[815],{"type":51,"tag":172,"props":816,"children":817},{"style":184},[818],{"type":57,"value":376},{"type":51,"tag":172,"props":820,"children":821},{"class":174,"line":278},[822],{"type":51,"tag":172,"props":823,"children":824},{"style":184},[825],{"type":57,"value":826},"| summarize count() by error_message\n",{"type":51,"tag":172,"props":828,"children":829},{"class":174,"line":287},[830,835,839,843,847,851],{"type":51,"tag":172,"props":831,"children":832},{"style":184},[833],{"type":57,"value":834},"| where count_ == 1",{"type":51,"tag":172,"props":836,"children":837},{"style":190},[838],{"type":57,"value":203},{"type":51,"tag":172,"props":840,"children":841},{"style":184},[842],{"type":57,"value":208},{"type":51,"tag":172,"props":844,"children":845},{"style":184},[846],{"type":57,"value":412},{"type":51,"tag":172,"props":848,"children":849},{"style":184},[850],{"type":57,"value":329},{"type":51,"tag":172,"props":852,"children":853},{"style":184},[854],{"type":57,"value":334},{"type":51,"tag":221,"props":856,"children":858},{"id":857},"_5-error-rate-spike",[859],{"type":57,"value":860},"5. Error Rate Spike",{"type":51,"tag":60,"props":862,"children":863},{},[864],{"type":57,"value":865},"Compare error rate to baseline:",{"type":51,"tag":161,"props":867,"children":869},{"className":163,"code":868,"language":165,"meta":166,"style":166},"axiom query \"['\u003Cdataset>']\n| where _time >= ago(6h)\n| summarize\n    total = count(),\n    errors = countif(status >= 500)\n  by bin(_time, 15m)\n| extend error_rate = errors * 100.0 \u002F total\n| sort by _time asc\" --start-time -6h -f json\n",[870],{"type":51,"tag":78,"props":871,"children":872},{"__ignoreMap":166},[873,892,900,907,915,923,931,939],{"type":51,"tag":172,"props":874,"children":875},{"class":174,"line":175},[876,880,884,888],{"type":51,"tag":172,"props":877,"children":878},{"style":179},[879],{"type":57,"value":8},{"type":51,"tag":172,"props":881,"children":882},{"style":184},[883],{"type":57,"value":187},{"type":51,"tag":172,"props":885,"children":886},{"style":190},[887],{"type":57,"value":193},{"type":51,"tag":172,"props":889,"children":890},{"style":184},[891],{"type":57,"value":266},{"type":51,"tag":172,"props":893,"children":894},{"class":174,"line":269},[895],{"type":51,"tag":172,"props":896,"children":897},{"style":184},[898],{"type":57,"value":899},"| where _time >= ago(6h)\n",{"type":51,"tag":172,"props":901,"children":902},{"class":174,"line":278},[903],{"type":51,"tag":172,"props":904,"children":905},{"style":184},[906],{"type":57,"value":293},{"type":51,"tag":172,"props":908,"children":909},{"class":174,"line":287},[910],{"type":51,"tag":172,"props":911,"children":912},{"style":184},[913],{"type":57,"value":914},"    total = count(),\n",{"type":51,"tag":172,"props":916,"children":917},{"class":174,"line":296},[918],{"type":51,"tag":172,"props":919,"children":920},{"style":184},[921],{"type":57,"value":922},"    errors = countif(status >= 500)\n",{"type":51,"tag":172,"props":924,"children":925},{"class":174,"line":305},[926],{"type":51,"tag":172,"props":927,"children":928},{"style":184},[929],{"type":57,"value":930},"  by bin(_time, 15m)\n",{"type":51,"tag":172,"props":932,"children":933},{"class":174,"line":530},[934],{"type":51,"tag":172,"props":935,"children":936},{"style":184},[937],{"type":57,"value":938},"| extend error_rate = errors * 100.0 \u002F total\n",{"type":51,"tag":172,"props":940,"children":941},{"class":174,"line":539},[942,947,951,955,960,964],{"type":51,"tag":172,"props":943,"children":944},{"style":184},[945],{"type":57,"value":946},"| sort by _time asc",{"type":51,"tag":172,"props":948,"children":949},{"style":190},[950],{"type":57,"value":203},{"type":51,"tag":172,"props":952,"children":953},{"style":184},[954],{"type":57,"value":208},{"type":51,"tag":172,"props":956,"children":957},{"style":184},[958],{"type":57,"value":959}," -6h",{"type":51,"tag":172,"props":961,"children":962},{"style":184},[963],{"type":57,"value":329},{"type":51,"tag":172,"props":965,"children":966},{"style":184},[967],{"type":57,"value":334},{"type":51,"tag":221,"props":969,"children":971},{"id":970},"_6-latency-degradation",[972],{"type":57,"value":973},"6. Latency Degradation",{"type":51,"tag":60,"props":975,"children":976},{},[977],{"type":57,"value":978},"Track percentile changes:",{"type":51,"tag":161,"props":980,"children":982},{"className":163,"code":981,"language":165,"meta":166,"style":166},"axiom query \"['\u003Cdataset>']\n| where _time >= ago(6h)\n| summarize\n    p50 = percentile(duration, 50),\n    p95 = percentile(duration, 95),\n    p99 = percentile(duration, 99)\n  by bin(_time, 15m)\n| sort by _time asc\" --start-time -6h -f json\n",[983],{"type":51,"tag":78,"props":984,"children":985},{"__ignoreMap":166},[986,1005,1012,1019,1027,1035,1043,1050],{"type":51,"tag":172,"props":987,"children":988},{"class":174,"line":175},[989,993,997,1001],{"type":51,"tag":172,"props":990,"children":991},{"style":179},[992],{"type":57,"value":8},{"type":51,"tag":172,"props":994,"children":995},{"style":184},[996],{"type":57,"value":187},{"type":51,"tag":172,"props":998,"children":999},{"style":190},[1000],{"type":57,"value":193},{"type":51,"tag":172,"props":1002,"children":1003},{"style":184},[1004],{"type":57,"value":266},{"type":51,"tag":172,"props":1006,"children":1007},{"class":174,"line":269},[1008],{"type":51,"tag":172,"props":1009,"children":1010},{"style":184},[1011],{"type":57,"value":899},{"type":51,"tag":172,"props":1013,"children":1014},{"class":174,"line":278},[1015],{"type":51,"tag":172,"props":1016,"children":1017},{"style":184},[1018],{"type":57,"value":293},{"type":51,"tag":172,"props":1020,"children":1021},{"class":174,"line":287},[1022],{"type":51,"tag":172,"props":1023,"children":1024},{"style":184},[1025],{"type":57,"value":1026},"    p50 = percentile(duration, 50),\n",{"type":51,"tag":172,"props":1028,"children":1029},{"class":174,"line":296},[1030],{"type":51,"tag":172,"props":1031,"children":1032},{"style":184},[1033],{"type":57,"value":1034},"    p95 = percentile(duration, 95),\n",{"type":51,"tag":172,"props":1036,"children":1037},{"class":174,"line":305},[1038],{"type":51,"tag":172,"props":1039,"children":1040},{"style":184},[1041],{"type":57,"value":1042},"    p99 = percentile(duration, 99)\n",{"type":51,"tag":172,"props":1044,"children":1045},{"class":174,"line":530},[1046],{"type":51,"tag":172,"props":1047,"children":1048},{"style":184},[1049],{"type":57,"value":930},{"type":51,"tag":172,"props":1051,"children":1052},{"class":174,"line":539},[1053,1057,1061,1065,1069,1073],{"type":51,"tag":172,"props":1054,"children":1055},{"style":184},[1056],{"type":57,"value":946},{"type":51,"tag":172,"props":1058,"children":1059},{"style":190},[1060],{"type":57,"value":203},{"type":51,"tag":172,"props":1062,"children":1063},{"style":184},[1064],{"type":57,"value":208},{"type":51,"tag":172,"props":1066,"children":1067},{"style":184},[1068],{"type":57,"value":959},{"type":51,"tag":172,"props":1070,"children":1071},{"style":184},[1072],{"type":57,"value":329},{"type":51,"tag":172,"props":1074,"children":1075},{"style":184},[1076],{"type":57,"value":334},{"type":51,"tag":66,"props":1078,"children":1080},{"id":1079},"anomaly-categories",[1081],{"type":57,"value":1082},"Anomaly Categories",{"type":51,"tag":1084,"props":1085,"children":1086},"table",{},[1087,1111],{"type":51,"tag":1088,"props":1089,"children":1090},"thead",{},[1091],{"type":51,"tag":1092,"props":1093,"children":1094},"tr",{},[1095,1101,1106],{"type":51,"tag":1096,"props":1097,"children":1098},"th",{},[1099],{"type":57,"value":1100},"Type",{"type":51,"tag":1096,"props":1102,"children":1103},{},[1104],{"type":57,"value":1105},"Detection Method",{"type":51,"tag":1096,"props":1107,"children":1108},{},[1109],{"type":57,"value":1110},"Indicates",{"type":51,"tag":1112,"props":1113,"children":1114},"tbody",{},[1115,1137,1157,1178,1199,1220,1241],{"type":51,"tag":1092,"props":1116,"children":1117},{},[1118,1127,1132],{"type":51,"tag":1119,"props":1120,"children":1121},"td",{},[1122],{"type":51,"tag":114,"props":1123,"children":1124},{},[1125],{"type":57,"value":1126},"Volume Spike",{"type":51,"tag":1119,"props":1128,"children":1129},{},[1130],{"type":57,"value":1131},"Z-score on count",{"type":51,"tag":1119,"props":1133,"children":1134},{},[1135],{"type":57,"value":1136},"Traffic surge, attack, incident",{"type":51,"tag":1092,"props":1138,"children":1139},{},[1140,1148,1152],{"type":51,"tag":1119,"props":1141,"children":1142},{},[1143],{"type":51,"tag":114,"props":1144,"children":1145},{},[1146],{"type":57,"value":1147},"Volume Drop",{"type":51,"tag":1119,"props":1149,"children":1150},{},[1151],{"type":57,"value":1131},{"type":51,"tag":1119,"props":1153,"children":1154},{},[1155],{"type":57,"value":1156},"Outage, data collection issue",{"type":51,"tag":1092,"props":1158,"children":1159},{},[1160,1168,1173],{"type":51,"tag":1119,"props":1161,"children":1162},{},[1163],{"type":51,"tag":114,"props":1164,"children":1165},{},[1166],{"type":57,"value":1167},"New Values",{"type":51,"tag":1119,"props":1169,"children":1170},{},[1171],{"type":57,"value":1172},"Left anti-join",{"type":51,"tag":1119,"props":1174,"children":1175},{},[1176],{"type":57,"value":1177},"New errors, new services",{"type":51,"tag":1092,"props":1179,"children":1180},{},[1181,1189,1194],{"type":51,"tag":1119,"props":1182,"children":1183},{},[1184],{"type":51,"tag":114,"props":1185,"children":1186},{},[1187],{"type":57,"value":1188},"Statistical Outlier",{"type":51,"tag":1119,"props":1190,"children":1191},{},[1192],{"type":57,"value":1193},"3-sigma rule",{"type":51,"tag":1119,"props":1195,"children":1196},{},[1197],{"type":57,"value":1198},"Extreme performance issue",{"type":51,"tag":1092,"props":1200,"children":1201},{},[1202,1210,1215],{"type":51,"tag":1119,"props":1203,"children":1204},{},[1205],{"type":51,"tag":114,"props":1206,"children":1207},{},[1208],{"type":57,"value":1209},"Rare Events",{"type":51,"tag":1119,"props":1211,"children":1212},{},[1213],{"type":57,"value":1214},"Count = 1",{"type":51,"tag":1119,"props":1216,"children":1217},{},[1218],{"type":57,"value":1219},"Unusual conditions",{"type":51,"tag":1092,"props":1221,"children":1222},{},[1223,1231,1236],{"type":51,"tag":1119,"props":1224,"children":1225},{},[1226],{"type":51,"tag":114,"props":1227,"children":1228},{},[1229],{"type":57,"value":1230},"Error Spike",{"type":51,"tag":1119,"props":1232,"children":1233},{},[1234],{"type":57,"value":1235},"Error rate increase",{"type":51,"tag":1119,"props":1237,"children":1238},{},[1239],{"type":57,"value":1240},"Service degradation",{"type":51,"tag":1092,"props":1242,"children":1243},{},[1244,1252,1257],{"type":51,"tag":1119,"props":1245,"children":1246},{},[1247],{"type":51,"tag":114,"props":1248,"children":1249},{},[1250],{"type":57,"value":1251},"Latency Spike",{"type":51,"tag":1119,"props":1253,"children":1254},{},[1255],{"type":57,"value":1256},"Percentile increase",{"type":51,"tag":1119,"props":1258,"children":1259},{},[1260],{"type":57,"value":1261},"Performance issue",{"type":51,"tag":66,"props":1263,"children":1265},{"id":1264},"output-format",[1266],{"type":57,"value":1267},"Output Format",{"type":51,"tag":161,"props":1269,"children":1273},{"className":1270,"code":1271,"language":1272,"meta":166,"style":166},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","## Anomaly Report: \u003Cdataset>\n\n### Summary\n- Analysis period: \u003Ctimeframe>\n- Anomalies found: \u003Ccount>\n\n### Volume Anomalies\n| Time | Count | Expected | Z-Score |\n|------|-------|----------|---------|\n| ... | ... | ... | ... |\n\n### New Values\n- Field: `error_code`\n- New values: `TIMEOUT_ERROR`, `CONNECTION_REFUSED`\n\n### Statistical Outliers\n- Field: `duration`\n- Outliers: \u003Ccount> events above \u003Cthreshold>\n\n### Error Rate\n- Baseline: X%\n- Current: Y%\n- Change: +Z%\n\n### Recommendations\n1. \u003CInvestigation action>\n2. \u003CMonitoring suggestion>\n","markdown",[1274],{"type":51,"tag":78,"props":1275,"children":1276},{"__ignoreMap":166},[1277,1290,1298,1311,1325,1337,1344,1356,1401,1410,1451,1459,1471,1498,1542,1550,1563,1588,1601,1609,1622,1635,1648,1661,1669,1682,1696],{"type":51,"tag":172,"props":1278,"children":1279},{"class":174,"line":175},[1280,1285],{"type":51,"tag":172,"props":1281,"children":1282},{"style":190},[1283],{"type":57,"value":1284},"## ",{"type":51,"tag":172,"props":1286,"children":1287},{"style":179},[1288],{"type":57,"value":1289},"Anomaly Report: \u003Cdataset>\n",{"type":51,"tag":172,"props":1291,"children":1292},{"class":174,"line":269},[1293],{"type":51,"tag":172,"props":1294,"children":1295},{"emptyLinePlaceholder":44},[1296],{"type":57,"value":1297},"\n",{"type":51,"tag":172,"props":1299,"children":1300},{"class":174,"line":278},[1301,1306],{"type":51,"tag":172,"props":1302,"children":1303},{"style":190},[1304],{"type":57,"value":1305},"### ",{"type":51,"tag":172,"props":1307,"children":1308},{"style":179},[1309],{"type":57,"value":1310},"Summary\n",{"type":51,"tag":172,"props":1312,"children":1313},{"class":174,"line":287},[1314,1319],{"type":51,"tag":172,"props":1315,"children":1316},{"style":190},[1317],{"type":57,"value":1318},"-",{"type":51,"tag":172,"props":1320,"children":1322},{"style":1321},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1323],{"type":57,"value":1324}," Analysis period: \u003Ctimeframe>\n",{"type":51,"tag":172,"props":1326,"children":1327},{"class":174,"line":296},[1328,1332],{"type":51,"tag":172,"props":1329,"children":1330},{"style":190},[1331],{"type":57,"value":1318},{"type":51,"tag":172,"props":1333,"children":1334},{"style":1321},[1335],{"type":57,"value":1336}," Anomalies found: \u003Ccount>\n",{"type":51,"tag":172,"props":1338,"children":1339},{"class":174,"line":305},[1340],{"type":51,"tag":172,"props":1341,"children":1342},{"emptyLinePlaceholder":44},[1343],{"type":57,"value":1297},{"type":51,"tag":172,"props":1345,"children":1346},{"class":174,"line":530},[1347,1351],{"type":51,"tag":172,"props":1348,"children":1349},{"style":190},[1350],{"type":57,"value":1305},{"type":51,"tag":172,"props":1352,"children":1353},{"style":179},[1354],{"type":57,"value":1355},"Volume Anomalies\n",{"type":51,"tag":172,"props":1357,"children":1358},{"class":174,"line":539},[1359,1364,1369,1373,1378,1382,1387,1391,1396],{"type":51,"tag":172,"props":1360,"children":1361},{"style":190},[1362],{"type":57,"value":1363},"|",{"type":51,"tag":172,"props":1365,"children":1366},{"style":1321},[1367],{"type":57,"value":1368}," Time ",{"type":51,"tag":172,"props":1370,"children":1371},{"style":190},[1372],{"type":57,"value":1363},{"type":51,"tag":172,"props":1374,"children":1375},{"style":1321},[1376],{"type":57,"value":1377}," Count ",{"type":51,"tag":172,"props":1379,"children":1380},{"style":190},[1381],{"type":57,"value":1363},{"type":51,"tag":172,"props":1383,"children":1384},{"style":1321},[1385],{"type":57,"value":1386}," Expected ",{"type":51,"tag":172,"props":1388,"children":1389},{"style":190},[1390],{"type":57,"value":1363},{"type":51,"tag":172,"props":1392,"children":1393},{"style":1321},[1394],{"type":57,"value":1395}," Z-Score ",{"type":51,"tag":172,"props":1397,"children":1398},{"style":190},[1399],{"type":57,"value":1400},"|\n",{"type":51,"tag":172,"props":1402,"children":1404},{"class":174,"line":1403},9,[1405],{"type":51,"tag":172,"props":1406,"children":1407},{"style":190},[1408],{"type":57,"value":1409},"|------|-------|----------|---------|\n",{"type":51,"tag":172,"props":1411,"children":1413},{"class":174,"line":1412},10,[1414,1418,1423,1427,1431,1435,1439,1443,1447],{"type":51,"tag":172,"props":1415,"children":1416},{"style":190},[1417],{"type":57,"value":1363},{"type":51,"tag":172,"props":1419,"children":1420},{"style":1321},[1421],{"type":57,"value":1422}," ... ",{"type":51,"tag":172,"props":1424,"children":1425},{"style":190},[1426],{"type":57,"value":1363},{"type":51,"tag":172,"props":1428,"children":1429},{"style":1321},[1430],{"type":57,"value":1422},{"type":51,"tag":172,"props":1432,"children":1433},{"style":190},[1434],{"type":57,"value":1363},{"type":51,"tag":172,"props":1436,"children":1437},{"style":1321},[1438],{"type":57,"value":1422},{"type":51,"tag":172,"props":1440,"children":1441},{"style":190},[1442],{"type":57,"value":1363},{"type":51,"tag":172,"props":1444,"children":1445},{"style":1321},[1446],{"type":57,"value":1422},{"type":51,"tag":172,"props":1448,"children":1449},{"style":190},[1450],{"type":57,"value":1400},{"type":51,"tag":172,"props":1452,"children":1454},{"class":174,"line":1453},11,[1455],{"type":51,"tag":172,"props":1456,"children":1457},{"emptyLinePlaceholder":44},[1458],{"type":57,"value":1297},{"type":51,"tag":172,"props":1460,"children":1461},{"class":174,"line":28},[1462,1466],{"type":51,"tag":172,"props":1463,"children":1464},{"style":190},[1465],{"type":57,"value":1305},{"type":51,"tag":172,"props":1467,"children":1468},{"style":179},[1469],{"type":57,"value":1470},"New Values\n",{"type":51,"tag":172,"props":1472,"children":1474},{"class":174,"line":1473},13,[1475,1479,1484,1489,1493],{"type":51,"tag":172,"props":1476,"children":1477},{"style":190},[1478],{"type":57,"value":1318},{"type":51,"tag":172,"props":1480,"children":1481},{"style":1321},[1482],{"type":57,"value":1483}," Field: ",{"type":51,"tag":172,"props":1485,"children":1486},{"style":190},[1487],{"type":57,"value":1488},"`",{"type":51,"tag":172,"props":1490,"children":1491},{"style":184},[1492],{"type":57,"value":576},{"type":51,"tag":172,"props":1494,"children":1495},{"style":190},[1496],{"type":57,"value":1497},"`\n",{"type":51,"tag":172,"props":1499,"children":1501},{"class":174,"line":1500},14,[1502,1506,1511,1515,1520,1524,1529,1533,1538],{"type":51,"tag":172,"props":1503,"children":1504},{"style":190},[1505],{"type":57,"value":1318},{"type":51,"tag":172,"props":1507,"children":1508},{"style":1321},[1509],{"type":57,"value":1510}," New values: ",{"type":51,"tag":172,"props":1512,"children":1513},{"style":190},[1514],{"type":57,"value":1488},{"type":51,"tag":172,"props":1516,"children":1517},{"style":184},[1518],{"type":57,"value":1519},"TIMEOUT_ERROR",{"type":51,"tag":172,"props":1521,"children":1522},{"style":190},[1523],{"type":57,"value":1488},{"type":51,"tag":172,"props":1525,"children":1526},{"style":1321},[1527],{"type":57,"value":1528},", ",{"type":51,"tag":172,"props":1530,"children":1531},{"style":190},[1532],{"type":57,"value":1488},{"type":51,"tag":172,"props":1534,"children":1535},{"style":184},[1536],{"type":57,"value":1537},"CONNECTION_REFUSED",{"type":51,"tag":172,"props":1539,"children":1540},{"style":190},[1541],{"type":57,"value":1497},{"type":51,"tag":172,"props":1543,"children":1545},{"class":174,"line":1544},15,[1546],{"type":51,"tag":172,"props":1547,"children":1548},{"emptyLinePlaceholder":44},[1549],{"type":57,"value":1297},{"type":51,"tag":172,"props":1551,"children":1553},{"class":174,"line":1552},16,[1554,1558],{"type":51,"tag":172,"props":1555,"children":1556},{"style":190},[1557],{"type":57,"value":1305},{"type":51,"tag":172,"props":1559,"children":1560},{"style":179},[1561],{"type":57,"value":1562},"Statistical Outliers\n",{"type":51,"tag":172,"props":1564,"children":1566},{"class":174,"line":1565},17,[1567,1571,1575,1579,1584],{"type":51,"tag":172,"props":1568,"children":1569},{"style":190},[1570],{"type":57,"value":1318},{"type":51,"tag":172,"props":1572,"children":1573},{"style":1321},[1574],{"type":57,"value":1483},{"type":51,"tag":172,"props":1576,"children":1577},{"style":190},[1578],{"type":57,"value":1488},{"type":51,"tag":172,"props":1580,"children":1581},{"style":184},[1582],{"type":57,"value":1583},"duration",{"type":51,"tag":172,"props":1585,"children":1586},{"style":190},[1587],{"type":57,"value":1497},{"type":51,"tag":172,"props":1589,"children":1591},{"class":174,"line":1590},18,[1592,1596],{"type":51,"tag":172,"props":1593,"children":1594},{"style":190},[1595],{"type":57,"value":1318},{"type":51,"tag":172,"props":1597,"children":1598},{"style":1321},[1599],{"type":57,"value":1600}," Outliers: \u003Ccount> events above \u003Cthreshold>\n",{"type":51,"tag":172,"props":1602,"children":1604},{"class":174,"line":1603},19,[1605],{"type":51,"tag":172,"props":1606,"children":1607},{"emptyLinePlaceholder":44},[1608],{"type":57,"value":1297},{"type":51,"tag":172,"props":1610,"children":1612},{"class":174,"line":1611},20,[1613,1617],{"type":51,"tag":172,"props":1614,"children":1615},{"style":190},[1616],{"type":57,"value":1305},{"type":51,"tag":172,"props":1618,"children":1619},{"style":179},[1620],{"type":57,"value":1621},"Error Rate\n",{"type":51,"tag":172,"props":1623,"children":1625},{"class":174,"line":1624},21,[1626,1630],{"type":51,"tag":172,"props":1627,"children":1628},{"style":190},[1629],{"type":57,"value":1318},{"type":51,"tag":172,"props":1631,"children":1632},{"style":1321},[1633],{"type":57,"value":1634}," Baseline: X%\n",{"type":51,"tag":172,"props":1636,"children":1638},{"class":174,"line":1637},22,[1639,1643],{"type":51,"tag":172,"props":1640,"children":1641},{"style":190},[1642],{"type":57,"value":1318},{"type":51,"tag":172,"props":1644,"children":1645},{"style":1321},[1646],{"type":57,"value":1647}," Current: Y%\n",{"type":51,"tag":172,"props":1649,"children":1651},{"class":174,"line":1650},23,[1652,1656],{"type":51,"tag":172,"props":1653,"children":1654},{"style":190},[1655],{"type":57,"value":1318},{"type":51,"tag":172,"props":1657,"children":1658},{"style":1321},[1659],{"type":57,"value":1660}," Change: +Z%\n",{"type":51,"tag":172,"props":1662,"children":1664},{"class":174,"line":1663},24,[1665],{"type":51,"tag":172,"props":1666,"children":1667},{"emptyLinePlaceholder":44},[1668],{"type":57,"value":1297},{"type":51,"tag":172,"props":1670,"children":1672},{"class":174,"line":1671},25,[1673,1677],{"type":51,"tag":172,"props":1674,"children":1675},{"style":190},[1676],{"type":57,"value":1305},{"type":51,"tag":172,"props":1678,"children":1679},{"style":179},[1680],{"type":57,"value":1681},"Recommendations\n",{"type":51,"tag":172,"props":1683,"children":1685},{"class":174,"line":1684},26,[1686,1691],{"type":51,"tag":172,"props":1687,"children":1688},{"style":190},[1689],{"type":57,"value":1690},"1.",{"type":51,"tag":172,"props":1692,"children":1693},{"style":1321},[1694],{"type":57,"value":1695}," \u003CInvestigation action>\n",{"type":51,"tag":172,"props":1697,"children":1699},{"class":174,"line":1698},27,[1700,1705],{"type":51,"tag":172,"props":1701,"children":1702},{"style":190},[1703],{"type":57,"value":1704},"2.",{"type":51,"tag":172,"props":1706,"children":1707},{"style":1321},[1708],{"type":57,"value":1709}," \u003CMonitoring suggestion>\n",{"type":51,"tag":66,"props":1711,"children":1713},{"id":1712},"investigation-priority",[1714],{"type":57,"value":1715},"Investigation Priority",{"type":51,"tag":1717,"props":1718,"children":1719},"ol",{},[1720,1730,1740,1750],{"type":51,"tag":110,"props":1721,"children":1722},{},[1723,1728],{"type":51,"tag":114,"props":1724,"children":1725},{},[1726],{"type":57,"value":1727},"Assess impact",{"type":57,"value":1729}," - Is this affecting users?",{"type":51,"tag":110,"props":1731,"children":1732},{},[1733,1738],{"type":51,"tag":114,"props":1734,"children":1735},{},[1736],{"type":57,"value":1737},"Correlate timing",{"type":57,"value":1739}," - What changed when anomaly started?",{"type":51,"tag":110,"props":1741,"children":1742},{},[1743,1748],{"type":51,"tag":114,"props":1744,"children":1745},{},[1746],{"type":57,"value":1747},"Check related systems",{"type":57,"value":1749}," - Shared dependencies?",{"type":51,"tag":110,"props":1751,"children":1752},{},[1753,1758],{"type":51,"tag":114,"props":1754,"children":1755},{},[1756],{"type":57,"value":1757},"Verify data quality",{"type":57,"value":1759}," - Is it a real issue or data problem?",{"type":51,"tag":66,"props":1761,"children":1763},{"id":1762},"when-not-to-use",[1764],{"type":57,"value":1765},"When NOT to Use",{"type":51,"tag":106,"props":1767,"children":1768},{},[1769,1779,1789,1799],{"type":51,"tag":110,"props":1770,"children":1771},{},[1772,1777],{"type":51,"tag":114,"props":1773,"children":1774},{},[1775],{"type":57,"value":1776},"Insufficient data",{"type":57,"value":1778},": Z-score needs ≥30 data points; new datasets lack meaningful baselines",{"type":51,"tag":110,"props":1780,"children":1781},{},[1782,1787],{"type":51,"tag":114,"props":1783,"children":1784},{},[1785],{"type":57,"value":1786},"Known thresholds",{"type":57,"value":1788},": If you have specific SLOs (e.g., \"p99 \u003C 500ms\"), use direct threshold queries",{"type":51,"tag":110,"props":1790,"children":1791},{},[1792,1797],{"type":51,"tag":114,"props":1793,"children":1794},{},[1795],{"type":57,"value":1796},"Real-time alerting",{"type":57,"value":1798},": Use Axiom Monitors for continuous anomaly detection, not ad-hoc analysis",{"type":51,"tag":110,"props":1800,"children":1801},{},[1802,1807],{"type":51,"tag":114,"props":1803,"children":1804},{},[1805],{"type":57,"value":1806},"Single data point",{"type":57,"value":1808},": Anomaly detection compares against distributions, not individual values",{"type":51,"tag":66,"props":1810,"children":1812},{"id":1811},"apl-reference",[1813],{"type":57,"value":1814},"APL Reference",{"type":51,"tag":60,"props":1816,"children":1817},{},[1818,1820,1826],{"type":57,"value":1819},"For query syntax, invoke the ",{"type":51,"tag":78,"props":1821,"children":1823},{"className":1822},[],[1824],{"type":57,"value":1825},"axiom-apl",{"type":57,"value":1827}," skill which provides anomaly detection patterns and function documentation.",{"type":51,"tag":1829,"props":1830,"children":1831},"style",{},[1832],{"type":57,"value":1833},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1835,"total":28},[1836,1847,1854,1864,1882,1902,1918,1931,1944,1962,1972,1985],{"slug":1825,"name":1825,"fn":1837,"description":1838,"org":1839,"tags":1840,"stars":24,"repoUrl":25,"updatedAt":1846},"write and debug APL queries for Axiom","APL query language reference for Axiom. Provides operators, functions, patterns, and CLI usage. Auto-invoked by specialized Axiom skills when writing or debugging APL queries.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1841,1844,1845],{"name":1842,"slug":1843,"type":16},"APL","apl",{"name":9,"slug":8,"type":16},{"name":14,"slug":15,"type":16},"2026-04-06T18:04:15.826882",{"slug":4,"name":4,"fn":5,"description":6,"org":1848,"tags":1849,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1850,1851,1852,1853],{"name":9,"slug":8,"type":16},{"name":22,"slug":23,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"slug":1855,"name":1855,"fn":1856,"description":1857,"org":1858,"tags":1859,"stars":24,"repoUrl":25,"updatedAt":1863},"explore-dataset","explore Axiom dataset schema and patterns","Explore an Axiom dataset to understand its schema, fields, volume, and patterns. Use when discovering a new dataset, investigating data structure, or understanding what data is available.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1860,1861,1862],{"name":9,"slug":8,"type":16},{"name":22,"slug":23,"type":16},{"name":14,"slug":15,"type":16},"2026-04-06T18:04:18.425533",{"slug":1865,"name":1865,"fn":1866,"description":1867,"org":1868,"tags":1869,"stars":24,"repoUrl":25,"updatedAt":1881},"find-traces","analyze OpenTelemetry distributed traces in Axiom","Analyze OpenTelemetry distributed traces from Axiom. Use when investigating a trace ID, finding traces by criteria (errors, latency, service), or debugging distributed system issues.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1870,1871,1874,1877,1878],{"name":9,"slug":8,"type":16},{"name":1872,"slug":1873,"type":16},"Debugging","debugging",{"name":1875,"slug":1876,"type":16},"Distributed Tracing","distributed-tracing",{"name":14,"slug":15,"type":16},{"name":1879,"slug":1880,"type":16},"OpenTelemetry","opentelemetry","2026-04-06T18:04:17.130694",{"slug":1883,"name":1883,"fn":1884,"description":1885,"org":1886,"tags":1887,"stars":1453,"repoUrl":1900,"updatedAt":1901},"axiom-alerting","manage Axiom monitors and notifiers","Create and manage Axiom monitors and notifiers via the v2 public API. Use when building alerting, routing notifications, validating monitor behavior, and maintaining alert configurations end-to-end.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1888,1891,1892,1895,1896,1897],{"name":1889,"slug":1890,"type":16},"API Development","api-development",{"name":9,"slug":8,"type":16},{"name":1893,"slug":1894,"type":16},"Messaging","messaging",{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"name":1898,"slug":1899,"type":16},"Operations","operations","https:\u002F\u002Fgithub.com\u002Faxiomhq\u002Fskills","2026-05-11T06:13:11.543806",{"slug":1903,"name":1903,"fn":1904,"description":1905,"org":1906,"tags":1907,"stars":1453,"repoUrl":1900,"updatedAt":1917},"axiom-sre","investigate incidents with Axiom","Expert SRE investigator for incidents and debugging. Uses hypothesis-driven methodology and systematic triage. Can query Axiom observability when available. Use for incident response, root cause analysis, production debugging, or log investigation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1908,1909,1910,1913,1914],{"name":9,"slug":8,"type":16},{"name":1872,"slug":1873,"type":16},{"name":1911,"slug":1912,"type":16},"Incident Response","incident-response",{"name":14,"slug":15,"type":16},{"name":1915,"slug":1916,"type":16},"SRE","sre","2026-04-06T18:04:27.289824",{"slug":1919,"name":1919,"fn":1920,"description":1921,"org":1922,"tags":1923,"stars":1453,"repoUrl":1900,"updatedAt":1930},"building-dashboards","build Axiom dashboards via API","Designs and builds Axiom dashboards via API. Covers chart types, APL and metrics\u002FMPL query patterns, SmartFilters, layout, and configuration options. Use when creating dashboards, migrating from Splunk, or configuring chart options.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1924,1925,1926,1929],{"name":1842,"slug":1843,"type":16},{"name":9,"slug":8,"type":16},{"name":1927,"slug":1928,"type":16},"Dashboards","dashboards",{"name":14,"slug":15,"type":16},"2026-04-06T18:04:23.452912",{"slug":1932,"name":1932,"fn":1933,"description":1934,"org":1935,"tags":1936,"stars":1453,"repoUrl":1900,"updatedAt":1943},"controlling-costs","reduce Axiom query costs","Analyzes Axiom query patterns to find unused data, then builds dashboards and monitors for cost optimization. Use when asked to reduce Axiom costs, find unused columns or field values, identify data waste, or track ingest spend.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1937,1938,1941,1942],{"name":9,"slug":8,"type":16},{"name":1939,"slug":1940,"type":16},"Cost Optimization","cost-optimization",{"name":1927,"slug":1928,"type":16},{"name":14,"slug":15,"type":16},"2026-04-06T18:04:22.202025",{"slug":1945,"name":1945,"fn":1946,"description":1947,"org":1948,"tags":1949,"stars":1453,"repoUrl":1900,"updatedAt":1961},"metrics-chart","render Axiom metrics as charts","Render Axiom metrics query results (application\u002Fvnd.metrics.v3+json) as line charts. Zero-dependency Unicode\u002FASCII by default; upgrades to inline PNG\u002FSVG\u002Fsixel via gnuplot when present. Use when you have a metrics v3 query response and want to see the series as a chart in the terminal or transcript.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1950,1951,1954,1957,1960],{"name":9,"slug":8,"type":16},{"name":1952,"slug":1953,"type":16},"Charts","charts",{"name":1955,"slug":1956,"type":16},"Data Visualization","data-visualization",{"name":1958,"slug":1959,"type":16},"Metrics","metrics",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:14.576127",{"slug":1963,"name":1963,"fn":1964,"description":1965,"org":1966,"tags":1967,"stars":1453,"repoUrl":1900,"updatedAt":1971},"query-metrics","query Axiom MetricsDB","Runs metrics queries against Axiom MetricsDB via scripts. Discovers available metrics, tags, and tag values. Use when asked to query metrics, explore metric datasets, check metric values, or investigate OTel metrics data.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1968,1969,1970],{"name":9,"slug":8,"type":16},{"name":1958,"slug":1959,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:12:32.381376",{"slug":1973,"name":1973,"fn":1974,"description":1975,"org":1976,"tags":1977,"stars":1453,"repoUrl":1900,"updatedAt":1984},"spl-to-apl","translate Splunk SPL to Axiom APL","Translates Splunk SPL queries to Axiom APL. Provides command mappings, function equivalents, and syntax transformations. Use when migrating from Splunk, converting SPL queries, or learning APL equivalents of SPL patterns.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1978,1979,1980,1983],{"name":1842,"slug":1843,"type":16},{"name":9,"slug":8,"type":16},{"name":1981,"slug":1982,"type":16},"Migration","migration",{"name":14,"slug":15,"type":16},"2026-04-06T18:04:20.939952",{"slug":1986,"name":1986,"fn":1987,"description":1988,"org":1989,"tags":1990,"stars":1453,"repoUrl":1900,"updatedAt":1998},"writing-evals","scaffold evals for the Axiom AI SDK","Scaffolds evaluation suites for the Axiom AI SDK. Generates eval files, scorers, flag schemas, and config from natural-language descriptions. Use when creating evals, writing scorers, setting up flag schemas, or configuring axiom.config.ts.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1991,1994,1995],{"name":1992,"slug":1993,"type":16},"AI Infrastructure","ai-infrastructure",{"name":9,"slug":8,"type":16},{"name":1996,"slug":1997,"type":16},"Evals","evals","2026-04-06T18:04:26.007097",{"items":2000,"total":287},[2001,2007,2014,2020],{"slug":1825,"name":1825,"fn":1837,"description":1838,"org":2002,"tags":2003,"stars":24,"repoUrl":25,"updatedAt":1846},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2004,2005,2006],{"name":1842,"slug":1843,"type":16},{"name":9,"slug":8,"type":16},{"name":14,"slug":15,"type":16},{"slug":4,"name":4,"fn":5,"description":6,"org":2008,"tags":2009,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2010,2011,2012,2013],{"name":9,"slug":8,"type":16},{"name":22,"slug":23,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"slug":1855,"name":1855,"fn":1856,"description":1857,"org":2015,"tags":2016,"stars":24,"repoUrl":25,"updatedAt":1863},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2017,2018,2019],{"name":9,"slug":8,"type":16},{"name":22,"slug":23,"type":16},{"name":14,"slug":15,"type":16},{"slug":1865,"name":1865,"fn":1866,"description":1867,"org":2021,"tags":2022,"stars":24,"repoUrl":25,"updatedAt":1881},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2023,2024,2025,2026,2027],{"name":9,"slug":8,"type":16},{"name":1872,"slug":1873,"type":16},{"name":1875,"slug":1876,"type":16},{"name":14,"slug":15,"type":16},{"name":1879,"slug":1880,"type":16}]