| 1 | # Investigations |
| 2 | |
| 3 | Ask Netdata anything about your infrastructure and get a deeply researched answer in minutes. Investigations turn your question and context into an analysis that correlates metrics, anomalies, and events across your systems. |
| 4 | |
| 5 | ## What Investigations are good for |
| 6 | |
| 7 | - Troubleshooting live incidents without manual data wrangling |
| 8 | - Analyzing the impact of deployments or config changes |
| 9 | - Cost and efficiency reviews (identify underutilized resources) |
| 10 | - Exploring longer‑term behavioral changes and trends |
| 11 | |
| 12 | ## Starting an investigation |
| 13 | |
| 14 | Two easy entry points: |
| 15 | |
| 16 | - `Troubleshoot with AI` button (top‑right): Captures the current chart, dashboard, or service context automatically, then you add your question |
| 17 | - `Insights` → `New Investigation`: Blank canvas for any custom prompt |
| 18 | |
| 19 | Reports complete in ~2 minutes and are saved in Insights; you’ll get an email when ready. |
| 20 | |
| 21 | ## Provide good context (get great results) |
| 22 | |
| 23 | Think of it like briefing a teammate. Include timeframes, environments, related services, symptoms, and recent changes. Example formats: |
| 24 | |
| 25 | ### Example: Troubleshoot a problem |
| 26 | Request: Why are my checkout‑service pods crashing repeatedly? |
| 27 | |
| 28 | Context: |
| 29 | ``` |
| 30 | - Started after: deployment at 14:00 UTC of version 2.3.1 |
| 31 | - Impact: Customer checkout failures, lost revenue ~$X/hour |
| 32 | - Recent changes: payment gateway integration update; workers 10→20 |
| 33 | - Logs: "connection refused to payment-service:8080", "Java heap space" |
| 34 | - Environment: production / eks-prod-us-east-1 |
| 35 | - Related: payment-service, inventory-service, redis-session-store |
| 36 | ``` |
| 37 | |
| 38 | ### Example: Analyze a change |
| 39 | Request: Compare metrics before/after the user‑authentication‑service deploy. |
| 40 | |
| 41 | Context: |
| 42 | ``` |
| 43 | - Service: user-authentication-service v2.2.0 |
| 44 | - Deployed: 2025‑01‑24 09:00 UTC |
| 45 | - Changes: JWT→Redis sessions; Argon2 hashing added |
| 46 | - Concern: intermittent logouts; rising redis_connected_clients |
| 47 | - Windows: 24h before vs 24h after |
| 48 | ``` |
| 49 | |
| 50 | ### Example: Cost optimization |
| 51 | Request: Identify underutilized nodes for cost savings. |
| 52 | |
| 53 | Context: |
| 54 | ``` |
| 55 | - Monthly compute: ~$12K |
| 56 | - Mixed workloads (prod + staging) |
| 57 | - Dev envs run 24/7; batch nodes idle 20h/day |
| 58 | - Goal: save $2–3K/month without reliability impact |
| 59 | ``` |
| 60 | |
| 61 | ## Availability and credits |
| 62 | |
| 63 | - Available to Business and Free Trial plans |
| 64 | - Each run consumes 1 AI credit (10 free per month on eligible plans) |
| 65 | |
| 66 | ## Related documentation |
| 67 | |
| 68 | - [Custom Investigations](/docs/netdata-ai/investigations/custom-investigations.md) |
| 69 | - [Scheduled Investigations](/docs/netdata-ai/investigations/scheduled-investigations.md) |
| 70 | - [Alert Troubleshooting](/docs/troubleshooting/troubleshoot.md) |