Troubleshooting 503s for Apps in Kubernetes

Get the precise time of the 503 occurrences

let start = todatetime('2023-11-07T04:25:00Z');
let end = todatetime('2023-11-07T05:00:00Z');
nginxAccessLogs
| where time_iso8601 between (start .. end)
| where host endswith ".aprimo.com"
| where status == 503
| where request_uri has '/api/ui/unauth-init'
| make-series count() default = 0 on time_iso8601 from start to end step 1s by host
| render timechart

Check if there were any pods running during the incident:

let start = todatetime('2023-11-07T04:00:00Z');
let end = todatetime('2023-11-07T05:00:00Z');
let nameprefix = "pod name prefix"
KubePodInventory
| where TimeGenerated between (start .. end)
| where Name contains nameprefix
| make-series count() default = 0 on TimeGenerated from start to end step 1m by PodStatus
| render timechart