Group failed queries by failure type

TL;DR

Use this query to group and count failed queries by failureType to quickly identify recurring failure patterns.

Problem / Use case

You want to identify which types of query failures occur most frequently in your system. This helps pinpoint recurring issues such as timeouts, permission errors, or syntax problems.

Query

source system/engine.queries
| filter queryInfo.queryOutcome.status == 'Failed'
| groupby queryInfo.queryOutcome.failureType
    aggregate count() as failures
| sortby failures desc

Expected output

A list of failure types sorted by frequency:

failure_type	failures
"query failed"	160
"bad request"	27
"query timed out"	10

Variations

• Filter by specific subsystem: Focus only on failures from a given subsystem or service, e.g. filter queryInfo.querySource == 'analytics-engine'.
• Calculate failure rate per type: Combine success and failure counts per failureType to compute a percentage of failed queries.
• Compare all statuses:

groupby queryInfo.queryOutcome.status aggregate count() as total