---
title: Notebook examples and use cases
source: https://docs.newrelic.com/docs/query-your-data/explore-query-data/notebooks/notebooks-examples
---

Get inspired by these practical notebook examples that demonstrate how to create compelling data stories for common use cases. Each example shows how to combine queries, visualizations, and narrative text to build effective analysis documents.

## Alert event investigation notebook

Create a comprehensive alert event investigation document that helps your team understand what happened and how to prevent it in the future.

### Structure

**Markdown block: Alert event overview**

```markdown
# Production API Outage - October 15, 2024

**Incident Start**: 2024-10-15 14:32 UTC
**Incident End**: 2024-10-15 15:18 UTC
**Duration**: 46 minutes
**Impact**: 15% of API requests failed

## Summary
Our main API experienced elevated error rates starting at 14:32 UTC...
```

**Query block: Error rate timeline**

```sql
SELECT count(*) AS 'Total Requests',
       filter(count(*), WHERE httpResponseCode >= 400) AS 'Errors'
FROM Transaction
WHERE appName = 'api-production'
TIMESERIES 1 minute
SINCE '2024-10-15 14:00:00' UNTIL '2024-10-15 16:00:00'
```

**Query block: Error breakdown by endpoint**

```sql
SELECT count(*) AS 'Error Count',
       average(duration) AS 'Avg Duration (ms)'
FROM Transaction
WHERE appName = 'api-production'
  AND httpResponseCode >= 400
FACET request.uri
SINCE '2024-10-15 14:00:00' UNTIL '2024-10-15 16:00:00'
ORDER BY count(*) DESC
```

**Markdown block: Root cause analysis**

```markdown
## Root Cause Analysis

### Timeline of Events
- **14:32**: Error rates began climbing for `/api/users` endpoint
- **14:35**: Database connection pool exhaustion detected
- **14:45**: Database scaling initiated
- **15:18**: Service fully recovered

### Contributing Factors
1. Unusual traffic spike during product launch
2. Database connection pool too small for peak load
3. Missing rate limiting on user registration endpoint
```

**Query block: Database performance during incident**

```sql
SELECT average(duration) AS 'Query Duration (ms)',
       count(*) AS 'Query Count'
FROM DatabaseSample
WHERE host = 'prod-db-01'
TIMESERIES 5 minutes
SINCE '2024-10-15 14:00:00' UNTIL '2024-10-15 16:00:00'
```

## Performance analysis notebook

Track and analyze application performance trends over time to identify optimization opportunities.

### Structure

**Markdown block: Analysis overview**

```markdown
# Weekly Performance Review - Week of October 14, 2024

## Objectives
- Review application response times across all services
- Identify performance regressions
- Track progress on optimization initiatives

## Key Metrics
- P95 response time target: < 500ms
- Error rate target: < 0.1%
- Apdex score target: > 0.85
```

**Query block: Response time trends**

```sql
SELECT percentile(duration, 50) AS 'P50',
       percentile(duration, 95) AS 'P95',
       percentile(duration, 99) AS 'P99'
FROM Transaction
WHERE appName IN ('web-frontend', 'api-backend', 'auth-service')
FACET appName
TIMESERIES 1 day
SINCE 7 days ago
```

**Query block: Error rate comparison**

```sql
SELECT percentage(count(*), WHERE error IS true) AS 'Error Rate %'
FROM Transaction
WHERE appName IN ('web-frontend', 'api-backend', 'auth-service')
FACET appName
TIMESERIES 1 day
SINCE 7 days ago
COMPARE WITH 1 week ago
```

**Markdown block: Analysis and recommendations**

```markdown
## Key Findings

### Performance Improvements ✅
- API backend P95 improved from 650ms to 420ms
- Authentication service error rate down 50%

### Areas for Attention ⚠️
- Web frontend P95 increased 15% week-over-week
- Database query timeouts up 25%

### Action Items
1. Investigate frontend asset loading delays
2. Optimize top 5 slowest database queries
3. Implement caching for user profile data
```

## Feature adoption tracking

Monitor how users interact with new features and measure adoption success.

### Structure

**Markdown block: Feature overview**

```markdown
# New Dashboard Feature Adoption - 30 Days Post-Launch

**Launch Date**: September 15, 2024
**Analysis Period**: September 15 - October 15, 2024

## Feature Description
New interactive dashboard builder with drag-and-drop widgets...

## Success Metrics
- **Primary**: 25% of active users create at least one custom dashboard
- **Secondary**: Average 3 widgets per custom dashboard
- **Tertiary**: < 5% bounce rate on dashboard creation page
```

**Query block: Daily active users creating dashboards**

```sql
SELECT uniqueCount(userId) AS 'Users Creating Dashboards'
FROM PageView
WHERE pageUrl LIKE '%/dashboard/create%'
TIMESERIES 1 day
SINCE 30 days ago
```

**Query block: Dashboard creation funnel**

```sql
SELECT funnel(userId,
  WHERE pageUrl LIKE '%/dashboard/create%' AS 'Started Creation',
  WHERE pageUrl LIKE '%/dashboard/create%' AND eventType = 'widget_added' AS 'Added Widget',
  WHERE eventType = 'dashboard_saved' AS 'Saved Dashboard'
)
FROM PageView, UserAction
SINCE 30 days ago
```

## Security monitoring notebook

Create ongoing security analysis to track potential threats and system vulnerabilities.

### Structure

**Markdown block: Security overview**

```markdown
# Weekly Security Review - October 21, 2024

## Monitoring Scope
- Failed authentication attempts
- Unusual API access patterns
- Database query anomalies
- File system access violations

## Alert Thresholds
- Failed logins: > 100/hour from single IP
- API rate limiting: > 1000 requests/minute
- Suspicious queries: containing SQL injection patterns
```

**Query block: Failed authentication patterns**

```sql
SELECT count(*) AS 'Failed Attempts',
       latest(remoteAddr) AS 'Source IP'
FROM Log
WHERE message LIKE '%authentication failed%'
FACET remoteAddr
SINCE 7 days ago
HAVING count(*) > 50
ORDER BY count(*) DESC
```

**Query block: API access anomalies**

```sql
SELECT count(*) AS 'Request Count',
       uniqueCount(userAgent) AS 'Unique User Agents'
FROM Transaction
WHERE appName = 'api-gateway'
FACET request.headers.x-forwarded-for
SINCE 24 hours ago
HAVING count(*) > 10000
ORDER BY count(*) DESC
```

## Business metrics dashboard

Track key business KPIs alongside technical metrics to understand the complete picture.

### Structure

**Markdown block: Business context**

```markdown
# Monthly Business & Technical Review - October 2024

## Business Objectives
- Increase user engagement by 15%
- Reduce customer support tickets by 20%
- Improve conversion rate to 3.5%

## Technical Performance Targets
- 99.9% uptime
- < 2 second page load times
- Zero security incidents
```

**Query block: User engagement metrics**

```sql
SELECT count(*) AS 'Page Views',
       uniqueCount(userId) AS 'Active Users',
       average(duration) AS 'Avg Session Duration'
FROM PageView
TIMESERIES 1 day
SINCE 30 days ago
```

**Query block: Conversion funnel**

```sql
SELECT funnel(userId,
  WHERE pageUrl = '/signup' AS 'Signup Page',
  WHERE pageUrl = '/signup/verify' AS 'Email Verified',
  WHERE pageUrl = '/onboarding/complete' AS 'Onboarding Complete',
  WHERE eventType = 'subscription_created' AS 'Converted'
)
FROM PageView, UserAction
SINCE 30 days ago
```

## Template: Investigation starter

Use this template as a starting point for any data investigation.

### Structure

**Markdown block: Investigation template**

```markdown
# Investigation: [ISSUE DESCRIPTION]

**Date**: [TODAY'S DATE]
**Investigator**: [YOUR NAME]
**Priority**: [HIGH/MEDIUM/LOW]

## Problem Statement
[Describe what you're investigating and why]

## Hypothesis
[What do you think might be causing the issue?]

## Investigation Plan
1. [First thing to check]
2. [Second thing to check]
3. [Third thing to check]

## Findings
_[Update this section as you discover information]_

## Next Steps
_[What actions should be taken based on your findings?]_
```

**Query block: Initial data exploration**

```sql
-- Replace with your initial query
SELECT count(*)
FROM [YourEventType]
WHERE [YourConditions]
SINCE 1 hour ago
```

> #### 💡 TIP
>
> Start each investigation with broad queries to understand the scope, then narrow down to specific areas based on your findings.

## Best practices for notebook examples

### Structure your story

1.  **Start with context**: Always begin with a Markdown block explaining the purpose
2.  **Follow logical flow**: Arrange queries in the order someone would naturally investigate
3.  **Provide conclusions**: End with Markdown blocks summarizing findings and next steps

### Make queries reusable

-   Use variables for dates, application names, and thresholds
-   Comment your NRQL to explain complex logic
-   Choose appropriate time ranges for the analysis type

### Visual design tips

-   Use consistent chart types throughout related queries
-   Choose colors that support your narrative
-   Add clear titles and labels to all visualizations
-   Use tables for detailed data, charts for trends and patterns

## What's next?

-   Learn how to [add queries to notebooks](https://docs.newrelic.com/docs/query-your-data/explore-query-data/notebooks/add-queries-to-notebooks)
-   Discover [sharing options](https://docs.newrelic.com/docs/query-your-data/explore-query-data/notebooks/share-notebooks) for your notebooks
-   Explore [NRQL examples](https://docs.newrelic.com/docs/nrql/nrql-examples) for more query inspiration