WEBVTT 00:00.120 --> 00:05.480 OK, so now that we have a prompt health service pushing data to I like service and we've set up a like 00:05.490 --> 00:11.610 data source in California and we can read it in the Explore tab Loki and shows log browser. 00:11.640 --> 00:13.590 We can continue when you open Loki. 00:13.590 --> 00:19.230 It already has some information from the Loki data source about the kind of information that it's already 00:19.230 --> 00:19.850 collecting. 00:19.860 --> 00:23.780 Now the information that we're seeing here has come from our prompt configuration. 00:23.790 --> 00:28.430 If we look at the prompt tail configuration from the last video where we download it, install the prompter 00:28.440 --> 00:31.020 binary, we create this one scrape config. 00:31.020 --> 00:32.550 Here we named system. 00:32.550 --> 00:34.440 It targets the local server. 00:34.470 --> 00:38.040 It has a job called VAR logs and it has a path variable. 00:38.040 --> 00:41.070 So it's scanning everything in the VAR log folder. 00:41.100 --> 00:42.150 Star Lock. 00:42.180 --> 00:43.970 That's a wild card for anything log. 00:43.980 --> 00:45.930 So VAR log stare, we can see that here. 00:45.960 --> 00:47.550 Our job is VAR logs. 00:47.550 --> 00:54.150 This file name is also created, and that's because the scraped config path property here is showing 00:54.150 --> 00:57.030 us all the file names it is found that follow that pattern. 00:57.220 --> 01:01.620 OK, now I can see both those options there because I've got them highlighted here so I can highlight 01:01.620 --> 01:02.730 it or highlighted again. 01:02.730 --> 01:05.100 Same thing the job I can make it active or not. 01:05.100 --> 01:11.580 If I my job active and then select VAR logs, it then shows me here this string here job equals VAR 01:11.580 --> 01:11.820 log. 01:11.970 --> 01:14.850 That string is called a log stream selector. 01:14.860 --> 01:19.700 That's one of the required things we need when we're doing a logical query in this window here. 01:19.710 --> 01:25.680 So very quickly we can just show logs and has put it into their job equals VAR logs is showing me everything 01:25.680 --> 01:28.230 in the job, VAR logs in the last one hour. 01:28.260 --> 01:34.110 So if I just scroll up, these are all the log lines from all the files that that scrape config has 01:34.110 --> 01:34.620 collected. 01:34.620 --> 01:38.100 I make it look at each of those individually and open it up, and we can see it has two labels file, 01:38.100 --> 01:39.030 name and job. 01:39.120 --> 01:43.290 So looking at job equals file logs, every one of these has job VAR logs. 01:43.320 --> 01:45.230 The file name will be different. 01:45.270 --> 01:50.550 For example, that's VAR log or slope, where as that is VAR log syslog. 01:50.940 --> 01:52.470 OK, so that's a log stream selector. 01:52.470 --> 01:58.260 So if we go back to log browser and data like that press phoneme press VAR Log Auth log, that's also 01:58.260 --> 01:59.310 a log stream selector. 01:59.310 --> 02:00.390 There is just a different one. 02:00.450 --> 02:01.200 I show logs. 02:01.230 --> 02:05.490 It's showing me all the logs it has or the labeled file name equals VAR log of log. 02:05.490 --> 02:10.110 So if I open those up, you'll see the label phoneme equals VAR log or log. 02:10.200 --> 02:16.020 So all these lines here all have thought I'm VAR local log and that's the log stream selector. 02:16.050 --> 02:19.530 Now we can do more with logs, streams like that we can select to log streams at the same time. 02:19.530 --> 02:24.880 So I go back to the log browser and all select auth and sites at the same time. 02:24.900 --> 02:27.980 So if we look at the log stream selector now, there are a few differences. 02:27.990 --> 02:34.490 There is a tilt there indicating it's using a rejects pattern equals rejects that is a port character. 02:34.500 --> 02:38.520 So VAR Log Auth Log or VAR log syslog slots, show logs. 02:39.180 --> 02:44.700 It's now showing me all the lines from both of those files so that one is VAR log syslog. 02:44.940 --> 02:46.130 I go further down. 02:46.130 --> 02:52.710 -- VAR log syslog and there's a VAR log or slot that was selected before going to my documentation 02:52.710 --> 02:53.160 website. 02:53.160 --> 02:56.510 Log stream selectors now inside looks, frame selectors out operators. 02:56.520 --> 02:59.320 OK, and this is an example of using a rejects. 02:59.340 --> 03:00.660 There are several of them here. 03:00.660 --> 03:03.330 There's a course which is the most common one you'll see. 03:03.330 --> 03:07.680 For example, job equals VAR log, so they're not equals down here. 03:07.680 --> 03:08.430 I've got fault. 03:08.430 --> 03:09.870 I'm not equal to VAR. 03:09.870 --> 03:17.100 Log syslog also rejects matches, so we've seen that we've searched for a rejects VAR log or log or 03:17.130 --> 03:20.200 VAR log syslog and rejects does not match. 03:20.220 --> 03:24.210 So all these examples here we can type those by hand into the search query. 03:24.240 --> 03:29.400 For example, if I was to delete that and create a curly brace, it's given me the available labels 03:29.400 --> 03:32.580 that it knows about in the last one hour only have two labels. 03:32.580 --> 03:37.980 So there's no point in me changing that to 24 hours, for example, because I still only have two to 03:37.980 --> 03:38.450 choose from. 03:38.460 --> 03:40.560 But if I just selected for, I'm there. 03:40.560 --> 03:45.120 It then says Equals and then it shows me what values I can search for and phoneme. 03:45.130 --> 03:49.020 That's everything that I have from tail scrape config figures found and put into the likely service 03:49.020 --> 03:49.490 for us. 03:49.500 --> 03:53.280 So for naming a DB and package manager log, so I could run that query. 03:53.280 --> 03:56.380 And that's everything it has in the last 24 hours. 03:56.400 --> 03:59.280 We can say that something was stored Lipsy bin, for example. 04:00.170 --> 04:07.520 OK, so now let's say I wanted to search for all of those two ways we have of doing that job equals 04:07.520 --> 04:12.110 VAR logs because just so happens, I have one scrape config and the job name was bollocks. 04:12.110 --> 04:15.530 Or I could say phoneme equals using a rejects. 04:15.620 --> 04:22.070 That's the title character they dot plus like that ended off with a curly brace press shift enter and 04:22.070 --> 04:26.000 that will return all the file names, for example VAR log syslog. 04:26.880 --> 04:28.870 But look at that one, that's VAR log syslog. 04:29.570 --> 04:31.250 Most of the time it's VAR log syslog. 04:31.310 --> 04:36.590 Sure, there's some auth ones there, but let's say I didn't want one of those comma I write file name 04:36.590 --> 04:43.100 again, not equals to syslog, for example, and then shift enter or press run query. 04:43.290 --> 04:46.400 OK, so it's given me all the file names, auth logs in there. 04:46.940 --> 04:51.710 We'll find the Debian Package Manager logs as well, but we won't find anything in there with the label 04:51.710 --> 04:56.450 phoneme, VAR log syslog or slog or slog or slog. 04:56.480 --> 05:00.710 Anyway, that is outlined here, so you can read more about the log stream. 05:00.710 --> 05:07.610 Select operators now looking at filter expressions, filter expressions allow us to filter what's returned 05:07.610 --> 05:08.770 from the log stream selector. 05:08.780 --> 05:11.750 Even more so, let's go back to job equals VAR logs. 05:12.260 --> 05:20.010 So everything that I can find where the label job equals bar logs, the job, VAR logs, I can say I 05:20.010 --> 05:23.990 really want the jobs with the word error in them. 05:23.990 --> 05:26.680 So some of those who have error was quite hard to see. 05:26.690 --> 05:28.370 So let's level equals error there. 05:28.400 --> 05:31.310 So I can say pop equals error. 05:32.300 --> 05:38.040 So everything in here now has the word error in it now for this filter expression here. 05:38.060 --> 05:43.310 It doesn't work to actually write equals equals like that or just a single equals needs to be a pipe 05:43.310 --> 05:43.940 equals. 05:44.030 --> 05:49.580 The pipe is quite an ambiguous character to use, but that's just how it does because pipe is the same 05:49.580 --> 05:51.640 as writing or in a rejects expression. 05:51.650 --> 05:55.460 But that's how you use that filter expression if you want to include everything with error. 05:55.490 --> 05:59.330 Then you use those two characters there in older versions of local. 05:59.360 --> 06:00.430 You could just do that. 06:00.470 --> 06:01.610 But that now shows an arrow. 06:01.610 --> 06:06.410 But the more recent versions that says Give me everything with the word error in it. 06:06.650 --> 06:10.670 OK, so we can say, give me everything that doesn't have error in it. 06:10.940 --> 06:14.240 So for that, we can use the not character not equals the error. 06:14.630 --> 06:18.200 So everything return doesn't have the word error in it somewhere. 06:18.530 --> 06:22.700 Now moving on, we could say we want to use the rejects in our query. 06:22.710 --> 06:26.750 So in that case would use the pipe and then the rejects tilt. 06:26.750 --> 06:30.710 And we could say, give me everything with error or info. 06:30.740 --> 06:36.470 Now that pipe is used twice here, there, in there in this expression, that means give me everything 06:36.470 --> 06:38.630 that matches the rejects and in the rejects. 06:38.630 --> 06:43.490 That just means the or so error or in fact, so we'll see everything with error or info. 06:43.520 --> 06:44.540 So shift enter. 06:44.900 --> 06:51.770 If I scroll down, it's error Iraq info error info so we can find error or info in those results that 06:51.770 --> 06:56.540 say I didn't want error or info, I could say not read GICS error or info. 06:57.080 --> 06:58.430 OK, so everything returns. 06:58.430 --> 07:02.210 Doesn't have error and it doesn't have info written anywhere in there. 07:02.660 --> 07:03.640 We can do more than that. 07:03.650 --> 07:11.210 Sometimes you might get a line with error and info in it, so you can say give me everything with error, 07:11.210 --> 07:13.160 but not if it contains info. 07:13.880 --> 07:18.530 So we're getting error there, and none of those lines also contain info, which is quite hard to find. 07:18.530 --> 07:20.930 And this was also anyway, but just showing that it can be done. 07:20.960 --> 07:22.190 Also, we could do another one. 07:22.190 --> 07:29.080 Invalid user rejects invalid user will find everything with invalid user, followed by bob or radius, 07:29.120 --> 07:30.740 so there may be a few those. 07:31.050 --> 07:32.150 And so there's none of those. 07:32.150 --> 07:35.420 If I check in the last two days, there are two occurrences of that. 07:35.450 --> 07:39.710 There was invalid user followed by bulb and invalid user, followed by Radix. 07:39.800 --> 07:46.160 I could just say give me everything with invalid user data, and we can see all the attempts where someone's 07:46.160 --> 07:50.300 tried to log into my server in all the usernames that they're using their IP addresses. 07:50.720 --> 07:54.740 This is pretty normal for a server on the internet, though, so if they were logging web server logs, 07:54.740 --> 07:58.940 we could also search for status equals for a three or statistical support base, right? 07:58.970 --> 08:03.230 That would be rich, except that if you know, rejects, rejects can become quite sophisticated and 08:03.230 --> 08:03.770 quite long. 08:03.770 --> 08:05.750 So we'll see some more rejections later. 08:05.810 --> 08:09.170 OK, now look at scalar vectors and series of scalar vectors. 08:09.260 --> 08:12.800 OK, so the data returns so far are returned as streams of log lines. 08:12.830 --> 08:19.040 OK, so log lines many, many local ones and we can look at them individually how Gryffindor tries to 08:19.040 --> 08:19.640 break them up. 08:19.650 --> 08:21.640 But that's the line as it's written in a text file. 08:21.650 --> 08:27.380 We can't really grasp that, despite the fact that Gravano in the Explore section is creating a graph 08:27.380 --> 08:27.750 of that. 08:27.770 --> 08:31.360 So, for example, I just put job equals VAR logs. 08:31.700 --> 08:36.770 It's drawing us a graph and it's colored it in some way corrupted into common information like info, 08:36.770 --> 08:37.880 error and unknown. 08:37.910 --> 08:42.470 If we look at the tool tip there now, if we use the log visualization in the Gryffindor dashboards, 08:42.470 --> 08:43.550 it won't show us a graph. 08:43.850 --> 08:46.240 It will just show us the log information. 08:46.350 --> 08:47.690 So I'll quickly demonstrate that. 08:47.690 --> 08:48.610 So I'll copy that. 08:48.620 --> 08:52.490 Go into create dashboard, add a new empty panel, select. 08:53.860 --> 08:55.630 The locks option just there. 08:56.770 --> 09:00.820 Select low key and base your local query, and so there it is, click out of it. 09:00.820 --> 09:01.820 So there are bonds. 09:01.840 --> 09:03.850 That's the information I was saying in the log panel. 09:03.880 --> 09:07.170 There's no graph there, but if you wanted to see a graph, we can do that. 09:07.180 --> 09:13.090 And that is by converting our log lines into scalar vectors or a series of scalable vectors. 09:13.140 --> 09:13.420 Okay. 09:13.420 --> 09:18.580 So what we do is we wrap our query into a function that somehow counts our data. 09:18.610 --> 09:24.490 So the first one count over time shows the total count of log lines for a time range going back into 09:24.490 --> 09:25.600 the Explore tab. 09:26.320 --> 09:28.940 I've got that and I'll do that query again. 09:28.950 --> 09:36.070 Curly brace job VAR logs count over time bracket and the range one minute. 09:36.610 --> 09:36.910 OK. 09:36.970 --> 09:43.660 So that has taken out log lines and created two Skyla vectors, so it's done a count of VAR logs where 09:43.660 --> 09:46.480 the file name label equals VAR log syslog or so. 09:46.480 --> 09:51.250 Another one at the bottom here with a phoneme label, says VAR Log Auth log in the last one hour. 09:51.250 --> 09:55.330 There are only two log files being written if I change that for last 24 hours. 09:55.450 --> 09:59.920 Then there are four log files that it can create scalar vectors for. 09:59.920 --> 10:04.990 It's quite hard to say there is some blue dots down here that would be for the dropper agent update 10:04.990 --> 10:11.380 log, and there's a yellow one just over here, which I'll zoom in to Nat to log Davian Package Manager 10:11.380 --> 10:12.250 log just down there. 10:12.280 --> 10:14.710 I can image that even more zoom out. 10:15.820 --> 10:21.670 So that is taking our data, our log lines and converting it into a graph by doing a count on the information 10:21.670 --> 10:24.670 that it's getting back for the log stream selector just there. 10:24.790 --> 10:27.940 Now this range parameter here we need to put in. 10:28.000 --> 10:33.820 That's a range of how far back it should count every time it creates one of these scales for us and 10:33.820 --> 10:34.210 graph. 10:34.270 --> 10:42.250 So for example, if I look at this value just here for VAR log syslog, it says 16 in the last one minute 10:42.250 --> 10:43.540 that they're that range. 10:43.570 --> 10:47.520 There are 16 lines in VAR log syslog at that point there. 10:47.530 --> 10:53.230 In the last one minute, there are 21 occurrences of a log line in VAR log systems, and that's what 10:53.230 --> 10:53.980 the one minute is. 10:54.250 --> 10:56.980 I could say give me that for one hour shift. 10:56.980 --> 10:58.310 Enter to update that. 10:58.330 --> 11:00.520 Okay, so now the graph is a little different. 11:00.880 --> 11:01.630 Zoom out. 11:02.380 --> 11:07.110 We can see here that at this point here in the last one hour, there are one thousand three hundred 11:07.130 --> 11:10.090 twenty one lines in the VAR log syslog for. 11:10.120 --> 11:11.350 I could even do one second. 11:12.350 --> 11:18.850 There's not many Detroit ten seconds ago, so the last ten seconds at this point here in the VAR log 11:18.850 --> 11:21.780 syslog, there were 11 occurrences go back to one minute. 11:21.790 --> 11:23.920 There are 21 occurrences in the last one minute there. 11:24.040 --> 11:25.240 That's what the range property is about. 11:25.240 --> 11:27.050 When you use these functions that cover your logs. 11:27.370 --> 11:34.750 The scale vectors does not write is very similar to count over time, except it's showing us the rate 11:34.750 --> 11:35.590 per second. 11:35.620 --> 11:42.550 So once again, if I was to look at that value there, there is a rate of zero point six six seven log 11:42.550 --> 11:46.120 lines per second in the last one minute at that point. 11:46.270 --> 11:47.440 So that's how you read that. 11:47.530 --> 11:52.710 We can also do a bytes over time count shift into via Zoom into that section there. 11:52.750 --> 11:57.070 That is because sometimes a log line might be very long and contain a lot of bytes. 11:57.070 --> 12:01.180 You may want to know something like that, and we can also get the rights of the bytes per second as 12:01.180 --> 12:05.770 well when we're converting our query into a scalable vector. 12:05.800 --> 12:07.720 We could also limit it to using a filter expression. 12:07.720 --> 12:13.960 For example, a copy that shift into job equals bar logs that contain error, but we're counting over 12:13.960 --> 12:16.630 time with the right of one hour in that time, right? 12:16.780 --> 12:19.210 So much nicer to last 12 hours. 12:19.360 --> 12:21.010 Last 24 hours. 12:21.160 --> 12:26.320 So count over time VAR logs that contain the word error at this point here, for the last one hour, 12:26.350 --> 12:27.970 there were 360 entries. 12:28.100 --> 12:29.660 OK, now aggregate functions. 12:29.680 --> 12:32.650 Now what we've been looking at so far are series of vector scales. 12:32.650 --> 12:34.510 So I'm getting two series here. 12:34.540 --> 12:40.000 So when doing the count over time job because VAR logs for one hour, for example, it's giving me a 12:40.000 --> 12:42.520 new series broken up by phone. 12:42.520 --> 12:48.520 I'm there, so I'm doing job because violence, but because each of my log lines has two labels in it, 12:48.520 --> 12:49.960 developing a file name. 12:49.960 --> 12:53.870 It's given me four different series and you can see in the different colors. 12:53.890 --> 12:59.830 Now I can do a total of all of those, which would then become a single, scalable vector by wrapping 12:59.830 --> 13:02.680 that into an aggregate function such as sum. 13:02.680 --> 13:04.930 So sum is one of them shift. 13:04.930 --> 13:07.660 And so it's now giving me the total of all of them. 13:07.660 --> 13:11.710 It's no longer broken that up into the different series depended on the name of the label. 13:11.750 --> 13:12.160 It's now done. 13:12.160 --> 13:14.710 Some can't over time is now given me one. 13:14.740 --> 13:15.730 There are other ones as well. 13:15.730 --> 13:19.810 We can get the maximum of count over time or the minimum count over time. 13:19.840 --> 13:25.030 There are several of them, their average standard deviation of standard variance account, which is 13:25.030 --> 13:26.330 count the number of elements. 13:26.380 --> 13:27.280 So count. 13:28.090 --> 13:34.870 OK, so here there was to a three to three I here there was four file name series that contained log 13:34.870 --> 13:39.120 lines with label job logs and then down here got a bottom K and top K. 13:39.130 --> 13:45.400 Now they won't convert all our series into a single Skylar Vector like these other ones to above here. 13:45.430 --> 13:51.520 These will give us only two series or three series of the bottom values, depending on what we use the 13:51.520 --> 13:54.400 K or the top value dependent of what we use the case. 13:54.400 --> 13:59.470 So an example over here there are four series return because I can see that when I use count. 13:59.470 --> 14:03.720 So if I zoom into that, I really want to know where the values were highest. 14:03.730 --> 14:09.910 So I can say Top K two comma, and it's only going to show me the top two series now, even though there 14:09.910 --> 14:11.410 are four series to choose from. 14:11.440 --> 14:13.480 OK, so let's just show me the top two. 14:13.510 --> 14:16.810 I want to see what the bottom two series were in that collection there. 14:16.820 --> 14:21.050 So bottom to show me the bottom two series. 14:21.070 --> 14:26.710 So at that point, there were only two series that contained log lines being phoneme, VAR log syslog 14:26.710 --> 14:27.930 and full name also. 14:28.300 --> 14:30.710 But at this point, there are other fault names being written. 14:30.730 --> 14:33.810 That's a packager and drop of agent update. 14:33.850 --> 14:36.580 So that's the use of top and bottom k excite. 14:36.580 --> 14:37.660 Give me the bottom three. 14:38.380 --> 14:42.310 Now got one of three or four, which is just going to give me all of them anyway. 14:43.180 --> 14:46.060 OK, so there are some examples there that you can use. 14:46.060 --> 14:48.600 And of course, you can also filter those further down. 14:48.610 --> 14:54.190 So give me everything with error or everything with the info, etc. Now not only that, let's say l 14:54.190 --> 14:56.710 can't over time, VAR logs one minute. 14:57.710 --> 15:03.470 For example, returns four different series based on the labels in the information, so there are two 15:03.470 --> 15:04.070 labels here. 15:04.130 --> 15:08.930 Job because logs and fall name may course whatever the name of the phone name was, we could have a 15:08.930 --> 15:13.760 third label, which I'll show you in the next video and we can choose what we're going to group by. 15:13.790 --> 15:17.900 So, for example, I'm saying some give me the sum of everything. 15:17.900 --> 15:21.360 As one, I don't really want one anymore. 15:21.380 --> 15:24.530 I want to split them up again, and I'll use my phone name. 15:24.860 --> 15:25.970 So it's broken up again. 15:25.970 --> 15:30.050 So that's essentially exactly the same response as what was returned by that. 15:30.200 --> 15:33.470 But I'm saying explicitly to a group of by file name. 15:33.500 --> 15:40.310 Now this is good in those cases where you have more than two labels in your log lines, I only have 15:40.310 --> 15:42.430 two, so I'm not really changing in the query. 15:42.440 --> 15:44.630 Much so it's quite a useless query that one. 15:44.720 --> 15:48.860 Let's just say I had a label called host, for example, wicked group by host. 15:49.220 --> 15:53.810 And not only that wicked group, multiple log streams and cetera, you can read my documentation for 15:53.810 --> 15:55.610 examples if you want those kinds of things. 15:55.640 --> 15:59.460 Now, comparison operators is not the thing we can do with the aggregate functions there. 15:59.480 --> 16:04.810 For example, show me the count over time of job, VAR logs one minute where it's greater than four 16:05.450 --> 16:06.080 presenter. 16:06.500 --> 16:10.800 OK, so that's given me a total bang, the sum where the value was greater than four. 16:10.820 --> 16:14.870 So none of those values are less than four, but we could have less than four if we wanted to. 16:15.650 --> 16:16.370 There's nothing there. 16:16.400 --> 16:17.420 What about less than 10? 16:17.720 --> 16:20.680 I think there was some 20, I guess a few less than 20. 16:20.690 --> 16:24.200 So same things greater than greater than our equals, not equals. 16:24.770 --> 16:30.680 There's a few examples logical operators and we could say, give me something where the numbers are 16:30.680 --> 16:33.320 greater than four or less than equal to one. 16:33.740 --> 16:34.250 Copy that. 16:34.730 --> 16:35.510 Put that in there. 16:35.540 --> 16:37.130 Some kind of a time of job. 16:37.130 --> 16:40.340 VAR logs one minute credit and four or less than an equal to one. 16:40.350 --> 16:42.650 So everything's over for anyway. 16:42.660 --> 16:45.530 So this example or change up to 24 hours. 16:46.200 --> 16:48.800 So another example is between 100 and 200. 16:48.890 --> 16:49.430 Copy that. 16:50.790 --> 16:55.020 There's not very many values between 100 and 200 anyway. 16:55.200 --> 16:58.480 Operator order, that's the order of how operators are processed. 16:58.500 --> 17:00.150 That's common in computer programming. 17:00.180 --> 17:05.770 If you don't wrap your operations in brackets, it will default to a particular order. 17:05.820 --> 17:11.170 Example PAM does is an acronym that you can use to understand that will process parentheses first. 17:11.190 --> 17:17.430 If you don't have that, it will then move on to processing exponents, multiplication divisions, additions, 17:17.430 --> 17:18.780 subtractions in that order. 17:18.840 --> 17:24.780 Anyway, some examples there will say that that there are no parentheses in there, so it's processing 17:24.780 --> 17:29.790 the exponent first in the multiplication and division and also the modulus, then the addition. 17:29.790 --> 17:33.900 And that's the same equation, but with parentheses wrapped around everything. 17:33.900 --> 17:35.330 So that's a particular order. 17:36.400 --> 17:36.850 There we go. 17:37.240 --> 17:37.560 OK. 17:37.590 --> 17:42.460 Local, you can read more about local here, the official documentation, it's very versatile and it 17:42.460 --> 17:43.630 can do anything to it. 17:43.750 --> 17:45.940 OK, now become more useful when we can a dashboard later. 17:46.000 --> 17:51.580 Now, in the next video, I'm going to set up from table service on another server down here, showing 17:51.580 --> 17:56.860 you that you can set up multiple prompt health services or pointing to the same wiki service that Gryffindor 17:56.860 --> 17:58.740 is pointing to in this like data source. 17:58.750 --> 18:01.750 And you can have as many of those as you want on only the service anyway. 18:01.780 --> 18:02.290 Excellent.