Clarify scope and timeline first: confirm the dashboard’s date range, timezone, and source table(s). Ask if any deployments, manual refund runs, or finance reports occurred that day.Step 1 — Quick sanity checks- Compare totals day-over-day and hourly to see if spike is brief or sustained.sql
SELECT date_trunc('hour', refunded_at) AS hour, count(*) AS refunds
FROM refunds
WHERE refunded_at >= '2025-11-01'::date - interval '2 days'
GROUP BY 1 ORDER BY 1;
sql
SELECT refunded_date, COUNT(*) AS refunds, orders, ROUND(100.0*COUNT(*)/orders,2) AS refund_pct
FROM (
SELECT DATE(refunded_at) AS refunded_date, 1 AS refund
FROM refunds
WHERE refunded_at BETWEEN '2025-11-01' AND '2025-11-01' + interval '1 day'
) r
JOIN (
SELECT DATE(created_at) AS created_date, COUNT(*) AS orders
FROM orders
GROUP BY 1
) o ON r.refunded_date = o.created_date
GROUP BY refunded_date, orders;
sql
SELECT refund_batch_id, COUNT(*) AS cnt, SUM(amount) AS total_amount
FROM refunds
WHERE refunded_at::date = '2025-11-01'
GROUP BY refund_batch_id ORDER BY cnt DESC;
SELECT COUNT(*) FROM refunds WHERE refunded_at::date = '2025-11-01' AND user_id IS NULL;
sql
SELECT reason_code, operator_id, COUNT(*) AS cnt
FROM refunds
WHERE refunded_at::date = '2025-11-01'
GROUP BY 1,2 ORDER BY cnt DESC;
sql
SELECT amount, COUNT(*) FROM refunds WHERE refunded_at::date = '2025-11-01' GROUP BY 1 ORDER BY 2 DESC LIMIT 20;
sql
SELECT p.sku, COUNT(*) AS cnt
FROM refunds r JOIN orders o ON r.order_id=o.id JOIN products p ON o.product_id=p.id
WHERE r.refunded_at::date='2025-11-01' GROUP BY p.sku ORDER BY cnt DESC LIMIT 20;
