Top-level goal: quickly decide if this is a real business drop or a reporting/data issue. Prioritize fast, cheap checks first (SQL/observability), then deeper pipeline and instrumentation checks.1) Quick sanity SQL checks (5–15 min)- Total resolved-ticket count yesterday vs day-before and 7‑day avg:sql
SELECT date(resolved_at) as day, COUNT(*) as resolved
FROM tickets
WHERE date(resolved_at) >= current_date - interval '8 day'
GROUP BY 1 ORDER BY 1;
- Count by source/system (UI, API, ingestion process):sql
SELECT source, COUNT(*) FROM tickets WHERE date(resolved_at)=current_date-1 GROUP BY 1;
- Distinct agents/users resolving tickets:sql
SELECT COUNT(DISTINCT resolver_id) FROM tickets WHERE date(resolved_at)=current_date-1;
- Max/min timestamps and late-arriving rows:sql
SELECT MAX(created_at), MAX(updated_at) FROM ticket_ingest WHERE date(event_time)=current_date-1;
2) Instrumentation & dashboard layer (5–20 min)- Verify dashboard query returns expected rows directly in DB/Looker/BI SQL runner.- Check metric logic: filters, timezone, business day cutoff, deduplication logic changed?- Confirm no recent dashboard deploys or metric-definition edits (PRs, changelog).3) ETL / pipeline health (10–30 min)- Check recent job statuses, runtimes, error logs (Airflow/Kube/Cloud Dataflow).- Verify last successful run time and rows processed:sql
SELECT job_name, status, run_time, rows_processed FROM etl_job_runs WHERE run_time >= current_date-2 ORDER BY run_time DESC;
- Check for failed partitions or connector errors, schema changes, quota limits.4) Instrumentation at source (10–30 min)- Check upstream system logs (app servers, API gateway) for drops in submit events.- Validate event counts in raw events table vs resolved aggregates:sql
SELECT date(event_time), COUNT(*) FROM raw_ticket_events WHERE event_type='resolved' AND date(event_time)>=current_date-8 GROUP BY 1;
- Confirm no client-side deploy removed tracking or changed event names.5) Quick visualizations to run (5–15 min)- Time series: 30‑day resolved count with annotations for deploys/ETL failures.- Source breakdown bar chart (source/system).- Heatmap by hour-of-day x day to spot delayed processing.- Cumulative arrivals vs resolved to check backlog.6) Triage & next steps- If SQL/raw events show same drop → real business issue (notify stakeholders, investigate product/ops).- If raw events normal but aggregated metric low → bug in ETL/transform or dashboard logic (roll back change, re-run ETL).- If pipelines failed → re-run or repair and backfill; verify after backfill.- Document findings, incident timeline, mitigation, and preventive steps (alerts, SLA tests).Key notes: check timezones/cutoffs first, compare raw events vs aggregated, and surface pipeline/job errors. Prioritize actions that restore correct metric quickly (rerun/patch) while communicating status to execs.