fields Timestamp, LogLevel, Message
 \| filter LogLevel == "ERR"
 \| sort @timestamp desc
 \| limit 100

filter @type = "REPORT"
\| fields @requestId, @billedDuration
\| sort by @billedDuration desc
\| limit 100

filter @type = "REPORT"
\| stats sum(strcontains(@message, "Init Duration"))/count(*) * 100 as
  coldStartPct, avg(@duration)
  by bin(5m)

filter @type = "REPORT"
\| stats
    avg(@billedDuration) as Average,
    percentile(@billedDuration, 99) as NinetyNinth,
    percentile(@billedDuration, 95) as NinetyFifth,
    percentile(@billedDuration, 90) as Ninetieth
    by bin(30m)

filter @type="REPORT"
\| stats avg(@maxMemoryUsed/1000/1000) as mean_MemoryUsed,
    min(@maxMemoryUsed/1000/1000) as min_MemoryUsed,
    max(@maxMemoryUsed/1000/1000) as max_MemoryUsed,
    percentile(@maxMemoryUsed/1000/1000, 95) as Percentile95

filter @type = "REPORT" and @maxMemoryUsed=@memorySize
\| stats
    count_distinct(@requestId)
    by bin(30m)

avgMemoryUsedPERC,
    avg(@billedDuration) as avgDurationMS
    by bin(5m)

filter @type = "REPORT"
\| stats
    max(@maxMemoryUsed / 1000 / 1000) as maxMemMB,
    avg(@maxMemoryUsed / 1000 / 1000) as avgMemMB,
    min(@maxMemoryUsed / 1000 / 1000) as minMemMB,
    (avg(@maxMemoryUsed / 1000 / 1000) / max(@memorySize / 1000 / 1000)) * 100 as avgMemUsedPct,
    avg(@billedDuration) as avgDurationMS
    by bin(30m)

filter @message like /Process exited/
\| stats count() by bin(30m)

filter @message like /Task timed out/
\| stats count() by bin(30m)

filter @type = "REPORT"
\| stats avg(@duration), max(@duration), min(@duration)
  by bin(5m)

filter @type = "REPORT"
\| stats max(@memorySize / 1000/ 1000) as provisonedMemMB,
        min(@maxMemoryUsed / 1000/ 1000) as smallestMemReqMB,
        avg(@maxMemoryUsed / 1000/ 1000) as avgMemUsedMB,
        max(@maxMemoryUsed / 1000/ 1000) as maxMemUsedMB,
        provisonedMemMB - maxMemUsedMB as overProvisionedMB

Created by: