---
title: Evidence
order: 1
description: Metrics, queries, logs, and files the agent collects to back up every claim.
---

# Evidence

**Evidence** is the raw material an Investibook investigation runs on. It lives
in the Studio panel on the right side of each workspace and is what every
report or recommendation ultimately points back to.

Two flavors show up there:

- **Workspace Evidence** — snapshots collected automatically when you bind a
  source (alert, cluster, ticket). It captures the cluster's state around the
  incident window: metrics, slow queries, logs, workload, resource control,
  TiKV thread CPU, and so on.
- **Diagnosis runs** — evidence the agent authors as it investigates. Each
  run produces *key evidence* (the things the agent decided actually matter)
  and *supporting evidence* (the rest of the trail).

## What's inside

Click any evidence card in Studio to drill into the files behind it. Common
items you'll see:

| File | Contents |
| --- | --- |
| **Workspace Report** | Top-level summary of the auto-collected snapshot. |
| **Metrics** | Peak / mean / utilization for the metrics that fired. |
| **Queries** | Slow queries and top-CPU SQL digests with execution counts. |
| **Log Stats** | Aggregated error / warning counts by component. |
| **Workload** | QPS, latency, and connection profile during the window. |
| **Resource Control** | Resource group quotas and pressure. |
| **TiKV Thread CPU** | Per-thread CPU breakdown when TiKV is the suspect. |
| **Agent Summary** | A condensed JSON / text view the agent uses as its working memory. |
| **Links** | Direct links into Clinic / Grafana / TopSQL for the relevant time range. |

Not every workspace has every file — Studio only shows what the source actually
yielded.

## How the agent uses evidence

When you ask a question, the agent:

1. Pulls in the workspace evidence already on disk.
2. Decides which skills and MCP tools to run for the extra context it needs.
3. Promotes the bits it finds decisive into **key evidence** in Studio, with
   the rest going to **supporting evidence**.
4. Writes a report that cites the evidence by name so you can follow the
   reasoning.

This is why evidence and chat aren't separate features — they're two views of
the same investigation. The chat shows the conversation, Studio shows the
artifacts the conversation produced.

## Trusting the evidence

A few habits help:

- **Open the file behind a claim.** Each metric / query / log line in Studio
  is backed by a JSON file with the underlying data. If a number looks
  surprising, open the file and check the time range, instance, or unit.
- **Disagree out loud.** If a report's "key evidence" doesn't match what you
  see in the cluster, say so in chat. The agent has context for the whole
  workspace and will re-examine.
- **Link to evidence when sharing.** A [shared workspace](/docs/features/sharing)
  carries the full evidence tree with it — you don't need to copy the
  screenshots; the recipient can drill into the same files you saw.

## Where it comes from

Evidence files live under the workspace's `evidences/` directory on the
backend and are exposed through the `/api/workspace/{id}/files` endpoint.
Skills that follow the evidence-writer convention drop their files there;
the Studio panel picks them up automatically.