# Effective Investigation

> The order in which to look at Telemetry Machine data when something is wrong.

When something is wrong, look in this order. [Writing Effective Queries](https://telemetrymachine.com/docs/writing-effective-queries) covers the queries themselves.

1. **Check alerting first.** What already fired tells you where to look.
2. **Check SLOs.** An SLO that is burning its error budget names the service and the kind of failure.
3. **Find what the bad events have in common.** Compare the failing or slow events with the rest: a route, a host, a customer, or a version that shows up much more often among them is a lead.
4. **Check deploy impact.** Group the bad events by `resource.service.version` over a window that covers the deploy.

**For agents.** With the Telemetry Machine MCP server:

```json
slos { "action": "list" }
surface { "slo": "checkout-availability" }
surface { "dataset": "shop-prod-traces", "since": "1h", "selection": "status_code = 2" }
run_query {
  "dataset": "shop-prod-traces",
  "description": "Errors by service version",
  "since": "6h",
  "select": "\"resource.service.version\", count(*) AS errors",
  "where": "status_code = 2",
  "group_by": "\"resource.service.version\""
}
```

---

All pages: https://telemetrymachine.com/docs/llms.txt