What problem does it solve? Investigating production errors on a Grafana + Loki stack usually means clicking through the Grafana UI or fighting typed CLI commands that silently return empty results on self-hosted instances. This Skill queries Loki directly through the classic REST API via gcx api passthrough, so you can find where errors cluster and drill into raw log lines without a browser. ## Core Features & Use Cases - Datasource discovery: Resolve the Loki datasource UID through the classic /api/datasources endpoint, avoiding the app-platform API that is often disabled by feature flags on self-hosted Grafana. - Scan-then-drill workflow: Aggregate with count_over_time over a wide time range to locate error spikes, then fetch raw log lines only for the narrow spike window, keeping context usage small. - Correct query encoding: Percent-encode the LogQL value exactly once with jq @uri and embed it in the proxy path, with verbose-mode verification to catch double-encoding. - Use Case: A service started throwing errors overnight. Scan the last 3 days with an hourly count_over_time query to find the spike at 03:00, then drill into that 30-minute window to extract the top error signatures and affected labels. ## Quick Start Ask the agent to scan the last three days of Loki logs for the service "foo" and summarize where errors cluster, then show the raw error lines from the busiest hour.
