Axiom

Compare service health metrics from a window *before* a deploy against a matching window *after* it. Produces four parallel queries — request rate, error rate, p95 latency, and unique error fingerprints — so a reviewer can see the deploy's blast radius in one place. Wire it into your release pipeline as a post-deploy check, or run it manually when triaging a suspected regression. The four result resources can be fed into a diff/report workflow or an LLM call for narrative output.

Cross-reference monitors, notifiers, and datasets to surface alerting gaps: datasets with no monitors at all, monitors targeting non-existent datasets, and monitors with no notifiers attached (silent alerts). Produces three resource families a reviewer can read at a glance. Use this monthly to keep monitor hygiene tight, or after a large dataset migration to ensure alerts followed the move.

Measure the cardinality (distinct value count) of selected fields over a recent window. High-cardinality dimensions are the usual suspect when queries get slow, dashboards lag, or storage costs spike. Use this to spot fields that exploded in cardinality between releases — common with un-bucketed request IDs leaking into a tag. Supply a comma-separated list of fields. The workflow emits one count per field as a single rollup row plus a top-N values listing per field.

Find monitors that fired more than `thresholdFires` times in the supplied lookback window. Alert fatigue is the silent killer of an on-call rotation; this workflow surfaces the worst offenders so you can tune thresholds, add hysteresis, or retire stale monitors. Pulls the full monitor list, then fetches per-monitor history for the monitorId given. (Per-monitor history requires an explicit ID — the API doesn't expose a fleet-wide history endpoint.) For fleet-wide auditing, invoke this workflow N times in parallel from a wrapper script.

Snapshot the retention configuration of every dataset in the workspace so governance/finops can see at a glance which datasets are unbounded, which carry costly long retention, and which are correctly capped. List-datasets returns one resource per dataset; downstream reports/CEL can filter on `retentionDays`, `useRetentionPeriod`, and `kind`.

Detect datasets that have stopped ingesting in a recent window. The most common cause is a broken collector — a service was redeployed, IAM was rotated, or the OTel endpoint changed. This workflow finds the gap before someone notices missing data in a dashboard the next morning. Step 1 lists every dataset, step 2 counts events per dataset over the configured window. A dataset with zero events in the window is a candidate outage — chain into a notifier workflow or open a ticket.

Triage errors in an Axiom dataset over a recent window. Runs two queries: a count-by-group rollup so you can see which services/scopes are noisy, and a sorted sample of the most-recent matching events (with trace_ids you can feed into `axiom-trace-lookup`). The error predicate is configurable because every team encodes "error" differently — pick whichever APL fragment matches your conventions.

End-to-end probe of Axiom's ingestion path. Writes a single tagged event, waits a configurable settle period, then queries for it. Use as a synthetic check after collector upgrades, network reconfigurations, or as a scheduled heartbeat (combine with `swamp serve` + a `trigger.schedule`).

Quick interrogation of an Axiom dataset: list everything visible to the token, tail the most recent events, and run a one-shot APL summary.

Audit an Axiom dataset for schema sanity. Dumps every column via APL `getschema`, then runs follow-up rollups so a human reviewer can spot dotted-vs-nested collisions (e.g. `service.name` vs `service\.name`), unusually sparse columns, and the per-group event volume distribution.

Golden-signals rollup over a configurable window: top N services by event volume, top N by p95 latency, and top N by error count. Three parallel APL queries grouped by the user-supplied service field — the canonical "Where's the noise coming from?" weekly review.

Fetch every span belonging to a single trace_id and write the ordered result so a workflow can chain off it (e.g. send to an LLM for explanation, or open a trace viewer URL). Lookback defaults to 24h so cold traces still resolve; widen with `lookback=7d` when investigating older incidents.

Compliance / security snapshot: lists every user, role, and group in the workspace. Run this on a schedule and diff successive runs to detect unexpected privilege grants, stale accounts, or role creep. Combine with a report extension for a quarterly access review.

Bulk-export every starred (saved) APL query in the workspace into swamp data. Use this for: - disaster-recovery snapshots (datasets can be rebuilt; the institutional knowledge in saved queries cannot) - GitOps — diff this workflow's output against a previous run to surface unauthorised changes to shared queries - migrations between Axiom workspaces (pair with `swamp data get` + a corresponding axiom-starred-query create call on the target) Each starred query is written as its own resource (factory), so individual ones can be retrieved by name without re-pulling the lot.