Query Splunk in plain English.

index=apps sourcetype=access_log earliest=-1h
| stats perc95(response_ms) as p95,
        count(eval(status>=500)) as errors,
        count as total by endpoint
| eval error_rate=round(errors/total*100, 2)
| where p95 > 500 AND error_rate > 2
| sort - p95

index=os sourcetype=df earliest=-24h
| stats earliest(usage_pct) as start,
        latest(usage_pct) as now by host, mount
| eval delta=round(now-start, 1)
| where now > 90
| sort - now
| table host mount now delta

index=web earliest=-7d
| iplocation clientip
| stats count(eval(action="purchase")) as purchases,
        dc(session_id) as visits by Country
| eval conv_rate=round(purchases/visits*100, 2)
| sort - purchases
| head 15

index=audit action=login user_role=admin earliest=-30d
| eval hr=tonumber(strftime(_time, "%H")),
        dow=strftime(_time, "%A")
| where hr < 8 OR hr > 18
          OR match(dow, "Saturday|Sunday")
| table _time user host src_ip dow hr

index=payments earliest=-1h
| iplocation merchant_ip
| stats count as tx,
        dc(Country) as countries,
        values(Country) as geo by card_hash
| where tx > 5 AND countries >= 3
| sort - tx