Query logs in plain English (and see the query)

I want to know: {{question: e.g. all failed logins for the auth service in the past 24 hours, grouped by user}}.

Do this:
1. **Pick the right source** — which log store, table, or index has the data
2. **Write the query** in the native syntax (SQL / KQL / Loki / Splunk — match what we use)
3. **Show me the query before running it** so I can sanity-check the filters and time window
4. **Run it** and show the result
5. **Interpret** — what stands out, what's normal, what's worth digging into next
6. **Suggest** one obvious follow-up query

Hard rule: if the query would scan more than {{limit: e.g. 7 days}} of data or hit a hot table, say so first and ask before running.