# Example Prompts

Copy-paste these prompts to get started. Replace placeholders with your own values.

## Incident Investigation

**Error Investigation**

> Investigate errors in `{{workload}}`. Check error rates, identify the most common error patterns in logs and traces, and correlate with recent events.

**Root Cause Analysis**

> Perform a root cause analysis on `{{workload}}`: Who is affected, What is failing, Where in the call chain, When it started, and Why.

**Alert Triage**

> Triage the alert on `{{monitor_name}}`. Check the current state, review recent firings, and investigate the underlying cause.

**Crashloop Diagnosis**

> Why is `{{workload}}` crashlooping? Check for OOMKill events, crash events, and recent changes.

***

## Performance

**Slow Endpoints**

> Find the slowest endpoints in `{{workload}}`. Show P50, P95, and P99 latency broken down by path.

**Slow Database Queries**

> Find the slowest database queries called by `{{workload}}`. Show query patterns, durations, and which endpoints trigger them.

**Resource Usage**

> Investigate CPU and memory usage for `{{workload}}`. Show trends, compare against requests/limits, and flag anomalies.

***

## Data Exploration

**Top Errors**

> Show me the top 10 error-producing workloads in `{{namespace}}` over the last 24 hours.

**Log Patterns**

> What are the most common log patterns for `{{workload}}`? Group by pattern and show hit counts.

**Change Correlation**

> What changed recently in `{{workload}}`? Check for image updates, config changes, scaling events, and restarts.

**Dependencies**

> Show me the dependencies of `{{workload}}` - which services does it call, and which services call it?

***

## Building

**Dashboard**

> Build a dashboard for `{{namespace}}` covering: error rates by workload, latency P95, pod restarts, and resource utilization.

**Monitor**

> Create a monitor that fires when error rate on `{{workload}}` exceeds 5% for more than 5 minutes, with severity S2.

**Log Parsing**

> Parse the unstructured logs from `{{workload}}`. Extract structured fields from the raw log content.

**Drop Rules**

> Create a drop rule to filter out health check logs from `{{workload}}`.

***

## Infrastructure

**Node Pressure**

> Are any nodes experiencing CPU, memory, or disk pressure? Show affected nodes and the workloads running on them.

**Over-Provisioned Resources**

> Find workloads in `{{namespace}}` that are over-provisioned - using significantly less CPU or memory than their requests.

**Pod Health**

> Show me all unhealthy pods in `{{namespace}}` - crashlooping, pending, or evicted.

***

## Tips for Effective Prompts

* **Be specific about scope** - include the workload, namespace, or cluster you care about
* **State what you want to see** - "Show me error rates broken down by endpoint" beats "look at errors"
* **Mention the signal** - if you specifically want traces vs. logs, say so
* **Ask follow-ups** - the Agent keeps context, so narrow down iteratively
* **Use @mentions** - reference entities with `@name` for precise resolution
* **Let the UI do the work** - if you're already filtered to the right scope, just ask the question