Notebook examples and use cases

Get inspired by these practical notebook examples that demonstrate how to create compelling data stories for common use cases. Each example shows how to combine queries, visualizations, and narrative text to build effective analysis documents.

Alert event investigation notebook

Create a comprehensive alert event investigation document that helps your team understand what happened and how to prevent it in the future.

Structure

Markdown block: Alert event overview

# Production API Outage - October 15, 2024

**Incident Start**: 2024-10-15 14:32 UTC
**Incident End**: 2024-10-15 15:18 UTC
**Duration**: 46 minutes
**Impact**: 15% of API requests failed

## Summary
Our main API experienced elevated error rates starting at 14:32 UTC...

Query block: Error rate timeline

SELECT count(*) AS 'Total Requests',
       filter(count(*), WHERE httpResponseCode >= 400) AS 'Errors'
FROM Transaction
WHERE appName = 'api-production'
TIMESERIES 1 minute
SINCE '2024-10-15 14:00:00' UNTIL '2024-10-15 16:00:00'

Query block: Error breakdown by endpoint

SELECT count(*) AS 'Error Count',
       average(duration) AS 'Avg Duration (ms)'
FROM Transaction
WHERE appName = 'api-production'
  AND httpResponseCode >= 400
FACET request.uri
SINCE '2024-10-15 14:00:00' UNTIL '2024-10-15 16:00:00'
ORDER BY count(*) DESC

Markdown block: Root cause analysis

## Root Cause Analysis

### Timeline of Events
- **14:32**: Error rates began climbing for `/api/users` endpoint
- **14:35**: Database connection pool exhaustion detected
- **14:45**: Database scaling initiated
- **15:18**: Service fully recovered

### Contributing Factors
1. Unusual traffic spike during product launch
2. Database connection pool too small for peak load
3. Missing rate limiting on user registration endpoint

Query block: Database performance during incident

SELECT average(duration) AS 'Query Duration (ms)',
       count(*) AS 'Query Count'
FROM DatabaseSample
WHERE host = 'prod-db-01'
TIMESERIES 5 minutes
SINCE '2024-10-15 14:00:00' UNTIL '2024-10-15 16:00:00'

Performance analysis notebook

Track and analyze application performance trends over time to identify optimization opportunities.

Structure

Markdown block: Analysis overview

# Weekly Performance Review - Week of October 14, 2024

## Objectives
- Review application response times across all services
- Identify performance regressions
- Track progress on optimization initiatives

## Key Metrics
- P95 response time target: < 500ms
- Error rate target: < 0.1%
- Apdex score target: > 0.85

Query block: Response time trends

SELECT percentile(duration, 50) AS 'P50',
       percentile(duration, 95) AS 'P95',
       percentile(duration, 99) AS 'P99'
FROM Transaction
WHERE appName IN ('web-frontend', 'api-backend', 'auth-service')
FACET appName
TIMESERIES 1 day
SINCE 7 days ago

Query block: Error rate comparison

SELECT percentage(count(*), WHERE error IS true) AS 'Error Rate %'
FROM Transaction
WHERE appName IN ('web-frontend', 'api-backend', 'auth-service')
FACET appName
TIMESERIES 1 day
SINCE 7 days ago
COMPARE WITH 1 week ago

Markdown block: Analysis and recommendations

## Key Findings

### Performance Improvements ✅
- API backend P95 improved from 650ms to 420ms
- Authentication service error rate down 50%

### Areas for Attention ⚠️
- Web frontend P95 increased 15% week-over-week
- Database query timeouts up 25%

### Action Items
1. Investigate frontend asset loading delays
2. Optimize top 5 slowest database queries
3. Implement caching for user profile data

Feature adoption tracking

Monitor how users interact with new features and measure adoption success.

Structure

Markdown block: Feature overview

# New Dashboard Feature Adoption - 30 Days Post-Launch

**Launch Date**: September 15, 2024
**Analysis Period**: September 15 - October 15, 2024

## Feature Description
New interactive dashboard builder with drag-and-drop widgets...

## Success Metrics
- **Primary**: 25% of active users create at least one custom dashboard
- **Secondary**: Average 3 widgets per custom dashboard
- **Tertiary**: < 5% bounce rate on dashboard creation page

Query block: Daily active users creating dashboards

SELECT uniqueCount(userId) AS 'Users Creating Dashboards'
FROM PageView
WHERE pageUrl LIKE '%/dashboard/create%'
TIMESERIES 1 day
SINCE 30 days ago

Query block: Dashboard creation funnel

SELECT funnel(userId,
  WHERE pageUrl LIKE '%/dashboard/create%' AS 'Started Creation',
  WHERE pageUrl LIKE '%/dashboard/create%' AND eventType = 'widget_added' AS 'Added Widget',
  WHERE eventType = 'dashboard_saved' AS 'Saved Dashboard'
)
FROM PageView, UserAction
SINCE 30 days ago

Security monitoring notebook

Create ongoing security analysis to track potential threats and system vulnerabilities.

Structure

Markdown block: Security overview

# Weekly Security Review - October 21, 2024

## Monitoring Scope
- Failed authentication attempts
- Unusual API access patterns
- Database query anomalies
- File system access violations

## Alert Thresholds
- Failed logins: > 100/hour from single IP
- API rate limiting: > 1000 requests/minute
- Suspicious queries: containing SQL injection patterns

Query block: Failed authentication patterns

SELECT count(*) AS 'Failed Attempts',
       latest(remoteAddr) AS 'Source IP'
FROM Log
WHERE message LIKE '%authentication failed%'
FACET remoteAddr
SINCE 7 days ago
HAVING count(*) > 50
ORDER BY count(*) DESC

Query block: API access anomalies

SELECT count(*) AS 'Request Count',
       uniqueCount(userAgent) AS 'Unique User Agents'
FROM Transaction
WHERE appName = 'api-gateway'
FACET request.headers.x-forwarded-for
SINCE 24 hours ago
HAVING count(*) > 10000
ORDER BY count(*) DESC

Business metrics dashboard

Track key business KPIs alongside technical metrics to understand the complete picture.

Structure

Markdown block: Business context

# Monthly Business & Technical Review - October 2024

## Business Objectives
- Increase user engagement by 15%
- Reduce customer support tickets by 20%
- Improve conversion rate to 3.5%

## Technical Performance Targets
- 99.9% uptime
- < 2 second page load times
- Zero security incidents

Query block: User engagement metrics

SELECT count(*) AS 'Page Views',
       uniqueCount(userId) AS 'Active Users',
       average(duration) AS 'Avg Session Duration'
FROM PageView
TIMESERIES 1 day
SINCE 30 days ago

Query block: Conversion funnel

SELECT funnel(userId,
  WHERE pageUrl = '/signup' AS 'Signup Page',
  WHERE pageUrl = '/signup/verify' AS 'Email Verified',
  WHERE pageUrl = '/onboarding/complete' AS 'Onboarding Complete',
  WHERE eventType = 'subscription_created' AS 'Converted'
)
FROM PageView, UserAction
SINCE 30 days ago

Template: Investigation starter

Use this template as a starting point for any data investigation.

Structure

Markdown block: Investigation template

# Investigation: [ISSUE DESCRIPTION]

**Date**: [TODAY'S DATE]
**Investigator**: [YOUR NAME]
**Priority**: [HIGH/MEDIUM/LOW]

## Problem Statement
[Describe what you're investigating and why]

## Hypothesis
[What do you think might be causing the issue?]

## Investigation Plan
1. [First thing to check]
2. [Second thing to check]
3. [Third thing to check]

## Findings
_[Update this section as you discover information]_

## Next Steps
_[What actions should be taken based on your findings?]_

Query block: Initial data exploration

-- Replace with your initial query
SELECT count(*)
FROM [YourEventType]
WHERE [YourConditions]
SINCE 1 hour ago

Tip

Start each investigation with broad queries to understand the scope, then narrow down to specific areas based on your findings.

Best practices for notebook examples

Structure your story

Start with context: Always begin with a Markdown block explaining the purpose
Follow logical flow: Arrange queries in the order someone would naturally investigate
Provide conclusions: End with Markdown blocks summarizing findings and next steps

Make queries reusable

Use variables for dates, application names, and thresholds
Comment your NRQL to explain complex logic
Choose appropriate time ranges for the analysis type

Visual design tips

Use consistent chart types throughout related queries
Choose colors that support your narrative
Add clear titles and labels to all visualizations
Use tables for detailed data, charts for trends and patterns

What's next?

Learn how to add queries to notebooks
Discover sharing options for your notebooks
Explore NRQL examples for more query inspiration

Alert event investigation notebook.css-21sua1{background:none;border:none;width:0;padding:0;}

Structure

Performance analysis notebook

Structure

Feature adoption tracking

Structure

Security monitoring notebook

Structure

Business metrics dashboard

Structure

Template: Investigation starter

Structure

Tip

Best practices for notebook examples

Structure your story

Make queries reusable

Visual design tips

What's next?

Alert event investigation notebook