▸case-01 We need to configure tail-based sampling rules in the OpenTelemetry Collector to drop 90% of HTTP 200 trace spans while retaining all spans containing errors. Provide the otelcol collector pipeline config for this tail sampling processor. | pass→pass | 17,469 | 27,091 | +55% | 1 | 1 | 0% | 2,985 | 4,786 | +60% | 0 | 0 | — |
▸case-02 Write a Prometheus PromQL alert rule that triggers when container CPU utilization exceeds 85% of its allocated limit for more than 10 minutes based on cgroup metrics. | pass→pass | 9,712 | 9,067 | -7% | 1 | 1 | 0% | 1,818 | 2,212 | +22% | 0 | 0 | — |
▸case-03 Calculate the required disk storage and configure log retention bytes and hours for an Apache Kafka cluster receiving 500 GB of messages daily with a 7-day retention target across 3 broker replicas. | pass→pass | 16,347 | 22,819 | +40% | 1 | 1 | 0% | 3,219 | 4,865 | +51% | 0 | 0 | — |
▸case-04 We have JSON logs from a web service stored in Grafana Loki with field 'latency_ms'. Construct a LogQL query to calculate the 99th percentile response time over a 5-minute window for the service 'payment-api'. Some engineers suggested using simple line counting, but we need exact percentile metrics over the parsed numeric field. | pass→pass | 10,245 | 7,897 | -23% | 1 | 1 | 0% | 1,980 | 1,945 | -2% | 0 | 0 | — |
▸case-05 Write a Vector VRL (Vector Remap Language) script for a transform component that parses an incoming standard RFC5424 syslog string field named 'message', extracts the hostname and appname, and adds a fixed metadata field 'datacenter' set to 'us-east-1'. | pass→pass | 9,757 | 9,732 | -0% | 1 | 1 | 0% | 1,872 | 2,228 | +19% | 0 | 0 | — |
▸case-06 In Splunk, we have millions of unformatted application stack trace logs. Engineers want to manually write regexes for every error type, but we want an automated query to group similar error message patterns and show the frequency of each cluster. Write the SPL query. | pass→pass | 14,757 | 58,225 | +295% | 1 | 1 | 0% | 2,658 | 4,049 | +52% | 0 | 0 | — |
▸case-07 Configure a Fluent Bit parser configuration block for Java multiline stack traces where a new log entry starts with an ISO8601 timestamp followed by a log level, and subsequent indented stack trace lines belong to the same entry. | pass→pass | 16,537 | 11,430 | -31% | 1 | 1 | 0% | 3,322 | 2,606 | -22% | 0 | 0 | — |
▸case-08 Write a CloudWatch Logs Insights query that parses unstructured log lines containing 'duration=Xms', converts X to a numeric variable, filters for requests taking longer than 500ms, and sorts by duration descending. | pass→pass | 9,646 | 6,866 | -29% | 1 | 1 | 0% | 1,651 | 1,685 | +2% | 0 | 0 | — |
▸case-09 Write an Elasticsearch REST API request body (Query DSL) that searches the index 'app-logs-*' for documents where log.level is 'ERROR' in the last 1 hour, and aggregates counts by HTTP status code field 'http.response.status_code'. | pass→pass | 6,820 | 7,479 | +10% | 1 | 1 | 0% | 1,349 | 1,795 | +33% | 0 | 0 | — |
▸case-10 We receive raw log streams in logfmt style (key=value pairs like level=info method=POST status=200). Write a Vector VRL script snippet to convert this string into structured event fields. | pass→pass | 8,769 | 8,536 | -3% | 1 | 1 | 0% | 1,637 | 2,225 | +36% | 0 | 0 | — |
▸case-11 Write a Loki LogQL query for unstructured Nginx access logs formatted as '<remote_addr> - [<time>] "<method> <request>" <status>'. Extract 'method' and 'status' without writing complex regular expressions, then filter for status code 500. | pass→pass | 9,747 | 7,296 | -25% | 1 | 1 | 0% | 1,557 | 1,910 | +23% | 0 | 0 | — |
▸case-12 We need a Splunk SPL query to group log events originating from microservices that share a 'correlation_id'. Group events across microservices within a 10-minute span and calculate the duration between the first and last log event. | pass→pass | 11,225 | 8,911 | -21% | 1 | 1 | 0% | 2,277 | 2,143 | -6% | 0 | 0 | — |
▸case-13 Create a Fluentd configuration filter block using the concat plugin to combine multi-line Python traceback log records that begin with 'Traceback (most recent call last):' and continue until a line starts with a timestamp. | pass→pass | 14,355 | 25,239 | +76% | 1 | 1 | 0% | 2,476 | 5,268 | +113% | 0 | 0 | — |
▸case-14 Design an OpenSearch Ingest Pipeline processor that redacts credit card numbers (16 digits) from the 'message' field in incoming log documents, replacing digits with 'XXXX-XXXX-XXXX-XXXX'. | fail→fail | 10,791 | 11,846 | +10% | 1 | 1 | 0% | 2,193 | 2,887 | +32% | 0 | 0 | — |
▸case-15 Create a Prometheus/Loki alerting rule definition named 'HighErrorLogRate' that fires an alert if the rate of error logs matching '{app="auth-service"} |= "ERROR"' exceeds 10 errors per second over a 2-minute evaluation window. | pass→pass | 5,317 | 5,655 | +6% | 1 | 1 | 0% | 1,095 | 1,517 | +39% | 0 | 0 | — |
▸case-16 Construct a Vector configuration file containing a 'route' transform that splits incoming log streams into two outputs: 'error_logs' (where level == "error") and 'info_logs' (all remaining logs). | pass→pass | 12,436 | 8,110 | -35% | 1 | 1 | 0% | 2,479 | 2,015 | -19% | 0 | 0 | — |
▸case-17 Write the AWS CLI command or CloudWatch metric filter pattern specification to create a custom metric 'DatabaseConnectionErrors' in namespace 'AppMetrics' counting instances of log lines containing 'FATAL: database connection failed'. | pass→pass | 5,624 | 4,632 | -18% | 1 | 1 | 0% | 1,059 | 1,312 | +24% | 0 | 0 | — |
▸case-18 Write a Fluent Bit configuration section using a Lua filter script to append a calculated field 'payload_size_kb' by dividing the numeric field 'payload_bytes' by 1024. | pass→pass | 6,704 | 10,652 | +59% | 1 | 1 | 0% | 1,326 | 2,157 | +63% | 0 | 0 | — |
▸case-19 Write a Splunk SPL query to plot the count of HTTP 5xx errors aggregated into 15-minute time buckets over the past 24 hours, grouped by URI path. | pass→pass | 8,424 | 9,346 | +11% | 1 | 1 | 0% | 1,546 | 1,814 | +17% | 0 | 0 | — |
▸case-20 Write a Alertmanager inhibition rule configuration that suppresses critical log alerts for service 'payment-db' when a known 'MaintenanceWindow' severity alert is active for the same environment. | pass→pass | 8,237 | 7,095 | -14% | 1 | 1 | 0% | 1,535 | 1,783 | +16% | 0 | 0 | — |
▸case-21 Write a Grok pattern filter for parsing standard RFC 5424 syslog messages containing priority, version, timestamp, hostname, app-name, procid, msgid, and structured data. | pass→fail | 15,481 | 20,628 | +33% | 1 | 1 | 0% | 3,141 | 4,744 | +51% | 0 | 0 | — |
▸case-22 Construct an OpenSearch Query DSL JSON payload to bucket log records by 1-hour time intervals over the last day, with a nested sub-aggregation finding the top 5 distinct exception class names within each time bucket. | pass→pass | 9,486 | 7,907 | -17% | 1 | 1 | 0% | 1,503 | 1,720 | +14% | 0 | 0 | — |
▸case-23 Write a Vector configuration snippet using the geoip transform to enrich log records containing an IP address in 'client_ip' with country and city fields using a MaxMind GeoLite2 database file at '/etc/vector/GeoLite2-City.mmdb'. | pass→pass | 11,109 | 16,254 | +46% | 1 | 1 | 0% | 2,241 | 3,068 | +37% | 0 | 0 | — |