honeycomb-analysis

Query Honeycomb datasets, traces, and metrics for observability incident investigation.

Updated Mar 26, 2026
One-click install
npx skills add https://github.com/erwinv2k-TKG/AgentesVSC --skill honeycomb-analysis-erwinv2k-tkg
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: honeycomb-analysis
Source: https://github.com/erwinv2k-TKG/AgentesVSC/tree/main/packs/incidentfox/sre-agent/.claude/skills/observability-honeycomb
Command: npx skills add https://github.com/erwinv2k-TKG/AgentesVSC --skill honeycomb-analysis-erwinv2k-tkg

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires httpx, and includes scripts (resource) components.

What problem does it solve? Investigating production incidents in Honeycomb often leads to dumping raw events and missing the big picture. This Skill enforces a statistics-first workflow so you understand volume, error rates, and top error patterns before sampling individual events. ## Core Features & Use Cases - Statistics-First Investigation: The get_statistics.py script delivers total event counts, error rates, status code distribution, top services, and normalized error patterns in one call. - Custom Analytics Queries: Run aggregations (COUNT, P99, HEATMAP, COUNT_DISTINCT, and more) with filters and breakdowns via run_query.py. - Dataset, SLO, and Trigger Discovery: List available datasets, check SLO targets, and inspect alert triggers for any dataset. - Use Case: During an outage, run get_statistics.py on the production dataset to instantly see a 12% error rate concentrated in one service, then drill into the top error pattern with a filtered P99 latency query. ## Quick Start Ask the agent to get statistics for the production Honeycomb dataset over the last hour and summarize the top error patterns.

Frequently Asked Questions about honeycomb-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate errors in Honeycomb datasets?

Start with get_statistics.py on the target dataset to get total event count, error rate, status distribution, and top error patterns. Then use run_query.py with filters like http.status_code >= 500 and breakdowns by error.message to drill into specific failures.

How do I query P99 latency by service in Honeycomb?

Run run_query.py with --calc P99 --column duration_ms --breakdown service.name against your dataset. The script supports percentiles from P50 to P99 plus COUNT, SUM, AVG, HEATMAP, and COUNT_DISTINCT calculations.

Do I need a Honeycomb API key configured to run these scripts?

No API key setup is required in production because credentials are injected automatically by a proxy layer. For direct testing mode, set the HONEYCOMB_API_KEY environment variable, and optionally HONEYCOMB_API_ENDPOINT for EU regions.

Can I check Honeycomb SLOs and alert triggers from the command line?

Yes, run_query.py supports --list-slos and --list-triggers flags for any dataset. These return SLO names, targets, and time periods, plus trigger status showing which alerts are active or currently fired.

Why should I avoid dumping raw Honeycomb events during an incident?

Raw event dumps hide patterns in high-cardinality data and waste investigation time. The statistics-first approach surfaces error rates and normalized error patterns immediately, so you sample strategically only after understanding overall volume and distribution.