Pattern trend
log10x_pattern_trendTrack a log pattern's volume history over a chosen window with spike detection to determine if it is worsening, when it started, or if it spiked before.
Instructions
Return the volume history for a single pattern over a chosen window (e.g. 1h, 24h, 7d, 30d), with a sparkline and spike detection: ranked by byte volume (with cost overlay when $/GB is set). Call this after log10x_event_lookup when the user asks "is this getting worse", "has it been louder before", "when did it start", or wants temporal context on a pattern surfaced in an earlier step. Always state the observation window explicitly in the reply: "flat at 2/h for the last 6 months of observation, spiked at 13:58 today", and never claim history older than the window. Pass include to select the cohort: kept (default), dropped (offloaded-only trend, useful for "is the receiver dropping more of this lately"), or both (total ingest). The envelope reports which cohort the series represents so the agent never conflates kept-only with total volume.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| step | No | Data point interval. Default `auto` sizes the step to give about 12 to 30 buckets per window (1h→5m, 6h→15m, 1d/24h→1h, 7d→6h, 30d→1d). Override only when a specific resolution is required; an over-coarse step (e.g. 1h on a 1h window) produces a 2-point series with no usable trend shape. | auto |
| view | No | Output format. Always "summary": the structured envelope. Field retained for backward-compat. | summary |
| include | No | Which engine-decision cohort to scope the trend to. `kept` (default) = events that actually reached the destination (routeState=~"pass|", absence-tolerant). `dropped` = everything the receiver acted on, so everything the destination did NOT receive (offload | compact | tier_down | drop | sample). Pass `drop` for the literal hard-drop cohort alone. `both` = the pre-decision union; envelope adds a parallel `dropped_time_series` and `dropped_share_pct` so one call shows offload share over time. Use `dropped` to verify post-deploy realised savings or to chart "what we are offloading right now". Use `both` to overlay kept vs dropped on the same window. | kept |
| pattern | No | Pattern name (e.g., "Payment_Gateway_Timeout"). Provide either pattern or pattern_hash: pattern_hash is preferred when available (skips a metrics lookup). | |
| timeRange | No | Time range. '24h' and '1d' are equivalent (one-day window). Sub-day values show fine-grained trajectory around an incident. | 7d |
| environment | No | Environment nickname | |
| analyzerCost | No | SIEM ingestion cost in $/GB | |
| pattern_hash | No | The tenx_hash of the pattern (the 11-character pattern hash from top_patterns / preview_filter). Preferred over pattern when available. | |
| include_chart | No | Set include_chart=true to embed the rendered chart inline (large; default false to avoid response truncation). | |
| monthly_volume_gb | No | What-if volume lens (forecast mode): model the environment at THIS monthly volume (decimal GB/month) instead of its measured volume. The real per-pattern shares and pattern mix are held fixed; only absolute bytes and dollars scale, by one uniform factor. Use it to project a prospect onto their own scale, or to forecast a real env after growth. Pairs with siem_lens. This is a PROJECTION: the envelope stamps volume_actual_gb vs volume_projected_gb and the scale factor, and the note points at the POC for the caller real patterns. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| tool | Yes | ||
| view | No | summary | |
| images | No | ||
| actions | No | ||
| summary | Yes | ||
| warnings | No | ||
| truncated | No | ||
| next_cursor | No | ||
| render_hint | No | ||
| generated_at | Yes | ||
| schema_epoch | Yes | ||
| schema_version | Yes |