From dbe4cb1567477344c42102fad7e742d68329f98c Mon Sep 17 00:00:00 2001
From: Rebecca Tamachiro <rtamachiro@cloudflare.com>
Date: Tue, 15 Jul 2025 17:24:50 +0100
Subject: [PATCH 1/2] Create dedicated section for example and use graphql code
 block

---
 src/content/docs/aegis/analytics.mdx | 110 ++++++++++++++++++++++++++-
 1 file changed, 109 insertions(+), 1 deletion(-)

diff --git a/src/content/docs/aegis/analytics.mdx b/src/content/docs/aegis/analytics.mdx
index 6a96427eacca446..775e9978c32b992 100644
--- a/src/content/docs/aegis/analytics.mdx
+++ b/src/content/docs/aegis/analytics.mdx
@@ -11,7 +11,11 @@ Use the [GraphQL API](/analytics/graphql-api/) to get aggregate data and monitor
 
 <Render file="concurrent-connections-explainer" />
 
-Refer to the GraphQL Analytics API documentation to [get started](/analytics/graphql-api/getting-started/). The specific Aegis schema is called `aegisIpUtilizationAdaptiveGroups`.
+Refer to the [GraphQL Analytics API documentation](/analytics/graphql-api/getting-started/) for further guidance, or consider the  [example](#example) below for a quickstart.
+
+## Aegis schema
+
+The specific Aegis schema is called `aegisIpUtilizationAdaptiveGroups`.
 
 You can get average (`avg`) or maximum (`max`) utilization values (in percentage), and use the following dimensions:
 
@@ -29,3 +33,107 @@ You can get average (`avg`) or maximum (`max`) utilization values (in percentage
 
 - `popUtilizationKey` <Type text="string" />
     - The Cloudflare point of presence (PoP), the Aegis IP, and the origin IP and port. For example, `sjc 192.0.2.1 203.0.113.150:443`.
+
+## Example
+
+Refer to the query below to learn how to get average utilization and maximum utilization by point of presence, and filter the results. You can also select the button at the bottom to use this query for your account via the Cloudflare GraphQL API Explorer.
+
+```graphql graphql-api-explorer "popName: "<CLOUDFLARE_POP>"" "egressIp: "<YOUR_EGRESS_IP>"" "origin: "<ORIGIN_IP_AND_PORT>""
+query AegisIpUtilizationQuery(
+  $accountTag: string
+  $datetimeStart: string
+  $datetimeEnd: string
+) {
+  viewer {
+    utilization: accounts(filter: { accountTag: $accountTag }) {
+      avgByPopUtilization: aegisIpUtilizationAdaptiveGroups(
+        limit: 100
+        filter: {
+          datetimeFiveMinutes_geq: $datetimeStart
+          datetimeFiveMinutes_leq: $datetimeEnd
+        }
+        orderBy: [datetimeFiveMinutes_ASC]
+      ) {
+        avg {
+          utilization
+        }
+        dimensions {
+          datetimeFiveMinutes
+          popUtilizationKey
+        }
+      }
+
+      maxByPopUtilization: aegisIpUtilizationAdaptiveGroups(
+        limit: 100
+        filter: {
+          datetimeFiveMinutes_geq: $datetimeStart
+          datetimeFiveMinutes_leq: $datetimeEnd
+        }
+        orderBy: [datetimeFiveMinutes_ASC]
+      ) {
+        max {
+          utilization
+        }
+        dimensions {
+          datetimeFiveMinutes
+          popUtilizationKey
+        }
+      }
+
+      filterPopUtilization: aegisIpUtilizationAdaptiveGroups(
+        limit: 100
+        filter: {
+          datetimeFiveMinutes_geq: $datetimeStart
+          datetimeFiveMinutes_leq: $datetimeEnd
+          popName: "<CLOUDFLARE_POP>"
+        }
+        orderBy: [datetimeFiveMinutes_ASC]
+      ) {
+        max {
+          utilization
+        }
+        dimensions {
+          datetimeFiveMinutes
+          popUtilizationKey
+        }
+      }
+
+      filterIPUtilization: aegisIpUtilizationAdaptiveGroups(
+        limit: 100
+        filter: {
+          datetimeFiveMinutes_geq: $datetimeStart
+          datetimeFiveMinutes_leq: $datetimeEnd
+          egressIp: "<YOUR_EGRESS_IP>"
+        }
+        orderBy: [datetimeFiveMinutes_ASC]
+      ) {
+        max {
+          utilization
+        }
+        dimensions {
+          datetimeFiveMinutes
+          popUtilizationKey
+        }
+      }
+
+      filterOriginUtilization: aegisIpUtilizationAdaptiveGroups(
+        limit: 100
+        filter: {
+          datetimeFiveMinutes_geq: $datetimeStart
+          datetimeFiveMinutes_leq: $datetimeEnd
+          origin: "<ORIGIN_IP_AND_PORT>"
+        }
+        orderBy: [datetimeFiveMinutes_ASC]
+      ) {
+        max {
+          utilization
+        }
+        dimensions {
+          datetimeFiveMinutes
+          popUtilizationKey
+        }
+      }
+    }
+  }
+}
+```
\ No newline at end of file

From f4e4baecb5b095bca5dd30b826674a974629154b Mon Sep 17 00:00:00 2001
From: Rebecca Tamachiro <rtamachiro@cloudflare.com>
Date: Wed, 16 Jul 2025 09:46:28 +0100
Subject: [PATCH 2/2] Call out variables and placeholders to replace

---
 src/content/docs/aegis/analytics.mdx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/content/docs/aegis/analytics.mdx b/src/content/docs/aegis/analytics.mdx
index 775e9978c32b992..87252d3d70a2e4e 100644
--- a/src/content/docs/aegis/analytics.mdx
+++ b/src/content/docs/aegis/analytics.mdx
@@ -36,7 +36,9 @@ You can get average (`avg`) or maximum (`max`) utilization values (in percentage
 
 ## Example
 
-Refer to the query below to learn how to get average utilization and maximum utilization by point of presence, and filter the results. You can also select the button at the bottom to use this query for your account via the Cloudflare GraphQL API Explorer.
+Refer to the query below to learn how to get average utilization and maximum utilization by point of presence, and filter the results.
+
+You can also select the button at the bottom to use this query for your account via the [Cloudflare GraphQL API Explorer](https://graphql.cloudflare.com/explorer). Make sure to provide your account ID and timestamps, and replace the placeholders for `popName`, `egressIp`, and `origin` as needed.
 
 ```graphql graphql-api-explorer "popName: "<CLOUDFLARE_POP>"" "egressIp: "<YOUR_EGRESS_IP>"" "origin: "<ORIGIN_IP_AND_PORT>""
 query AegisIpUtilizationQuery(