> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Run your first investigation

> Open the first issue Sazabi raised, read what it found, ask a follow-up in the issue's thread, and search the logs behind it.

When Sazabi detects a problem in your data, it opens an issue and investigates it. This walkthrough takes one issue from the report to a question of your own. It follows the [Quickstart](https://docs.sazabi.com/get-started/quickstart.md).

New projects also start with **Test issue: Checkout error spike**, created during setup to show the shape of an issue. Use a real issue here. If you have none yet, [Search logs](https://docs.sazabi.com/explore/search.md) works on any data you have sent.

## Find the issue

> [tab] CLI
>
> ```bash theme={"system"}
> npx -y @sazabi/cli@latest issues list --status open
> ```
>
> Copy the ID of the issue you want.

> [tab] Dashboard
>
> Open **Issues** in the sidebar and select an issue. The list filters by status, severity, type, and component, and you can search it.

## Read the root cause

> [tab] CLI
>
> ```bash theme={"system"}
> npx -y @sazabi/cli@latest issues get your-issue-id
> ```
>
> The output shows the issue's details and description, then its activity. The agent's report is printed with the entry that created the issue and holds what happened, why it happened, and the evidence. A `Thread:` line gives the command that opens the issue's thread, with its ID.

> [tab] Dashboard
>
> The issue page shows the **Description** and, under **Activity**, the agent's report: what happened, why it happened, and the evidence. The issue's properties, such as status and severity, are listed on the page.

## Ask a follow-up

Ask the agent anything the report leaves open, such as what changed before the issue opened.

> [tab] CLI
>
> Use the thread ID from the `Thread:` line:
>
> ```bash theme={"system"}
> npx -y @sazabi/cli@latest messages send 'What changed before this issue opened?' --thread-id your-thread-id --wait
> ```
>
> `--wait` prints the agent's reply when it finishes. To read the whole thread afterwards, run `npx -y @sazabi/cli@latest threads get your-thread-id`.

> [tab] Dashboard
>
> Type your question in **Ask about this issue** at the bottom of the issue page and send it. The thread opens with the issue's context already loaded.

## Search the logs behind it

Ask a question about the logs from around the time the issue opened. Use the component's name from the issue.

> [tab] CLI
>
> ```bash theme={"system"}
> npx -y @sazabi/cli@latest logs ask 'Show error logs from your-service' --since 2h
> ```
>
> The answer comes with its results, the time window, and a query ID that reruns the same query later. See [Search logs](https://docs.sazabi.com/explore/search.md).

> [tab] Dashboard
>
> In the issue's thread, ask the agent to search the logs, for example: `Show the error logs from your-service in the hour before this issue opened.` The agent shows the log search it ran.

## Verify

The agent's reply cites log lines from around the time the issue opened. In the CLI, the `logs ask` answer lists matching lines with their service and severity.

## Next steps

> [card] [Route notifications](https://docs.sazabi.com/triage/notifications.md)
>
> Send issue alerts to the channels your team watches.

> [card] [Hand off a root cause](https://docs.sazabi.com/fix/hand-off.md)
>
> Give an issue's root cause to your coding agent to fix.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.