Setting the file. One moment.
Chapter 51 · Investigate Metric
Subchapter 51.2
references/common-causes.mdMarkdown2 KBView on GitHub
Hypothesis taxonomy with confirming queries. Rank by evidence count when writing findings.
A version, flag, or experiment shipped near the anomaly start.
app_version / $lib_version — shift concentrated in one version is
strong evidence.$feature/<flag_key> separates exposed from control.Suggest pausing or reverting; offer posthog:annotation-create if no annotation exists.
A campaign started or ended, or source mix changed.
utm_source, utm_medium, utm_campaign, $referring_domain.The measurement changed, not the metric.
$lib_version — concentrated drop = SDK regression.posthog:read-data-schema (kind: "events") for recently renamed / deprecated events.Same product, different mix of users. New-user influx pulls engagement metrics down.
posthog:query-lifecycle — change in new / returning / resurrecting / dormant mix.posthog:query-retention comparing affected-period cohorts to prior.Split the metric per lifecycle status in findings.
Weekend dip, holiday trough, end-of-quarter spike. The
compare_to_prior_periods.py script catches
this directly.
JS error on a Safari release, mobile crash on a specific OS, regional CDN issue.
$browser, $browser_version, $os, $device_type, $geoip_country_code.posthog:query-error-tracking-issues-list.A consumer hit a quota or an upstream dependency degraded.
posthog:query-trends on API error events.posthog:query-logs for an error surge in the window.For warehouse-backed metrics: schema change, pipeline failure, view altered. The investigation tools can’t confirm this directly — flag as a candidate when no product-side cause fits and recommend the user check pipeline health.