queries.json

{
  "items": [
    {
      "value": "fuse",
      "name": "As Table",
      "description": "",
      "tags": []
    },
    {
      "value": "fuse | drop ustack",
      "name": "Table w/o ustack",
      "description": "",
      "tags": []
    },
    {
      "value": "sample",
      "name": "Sample the Shapes",
      "description": "",
      "tags": []
    },
    {
      "value": "cut stack",
      "name": "Just the Stack",
      "description": "",
      "tags": []
    },
    {
      "value": "callers:=union(stack[1])",
      "name": "Parent Callers",
      "description": "",
      "tags": []
    },
    {
      "value": "count() by stack",
      "name": "Count Stacks",
      "description": "",
      "tags": []
    },
    {
      "value": "count() by stack | depth:=len(stack) | drop stack | sort -r depth",
      "name": "Count Stacks by Depth",
      "description": "",
      "tags": []
    },
    {
      "value": "StackDepth:=union(len(stack)) by Process:=name",
      "name": "Stack Depth by Process",
      "description": "",
      "tags": []
    },
    {
      "value": "StackDepth:=union(len(stack)) by Process:=name | 28 in StackDepth",
      "name": "Stack Depth of 28",
      "description": "",
      "tags": []
    },
    {
      "value": "this[\"Stack Depth\"]:=union(len(stack)) by Process:=name",
      "name": "Stack Depth with Whitespace ",
      "description": "",
      "tags": []
    },
    {
      "value": "stack[1]==\"ip_queue_xmit\" | count() by name,stack:=stack[3:] | sort name",
      "name": "Ancestors of ip_queue_xmit",
      "description": "",
      "tags": []
    },
    {
      "value": "SELECT * FROM exec",
      "name": "SQL Execs as Table",
      "description": "",
      "tags": []
    },
    {
      "value": "SELECT * FROM exec ORDER by pcomm LIMIT 5",
      "name": "SQL Stuff",
      "description": "",
      "tags": []
    },
    {
      "value": "SELECT * FROM exec | union(ppid)",
      "name": "All Parent PIDs with Zed",
      "description": "",
      "tags": []
    },
    {
      "value": "SELECT union(ppid) as parents FROM exec GROUP BY parents",
      "name": "Parent PIDs in SQL",
      "description": "",
      "tags": []
    },
    {
      "value": "SELECT union(e.pid) as PIDs, s.name as Command, min(len(s.stack)) as MinDepth, max(len(s.stack)) as MaxDepth FROM exec e JOIN stack s on e.pcomm=s.name GROUP BY Command, MinDepth, MaxDepth, PIDs",
      "name": "Join PIDs and Stack Depths",
      "description": "",
      "tags": []
    }
  ],
  "name": "BPF"
}