-
Notifications
You must be signed in to change notification settings - Fork 23
Open
Labels
Description
Created from comment.
There still seems to be an issue with histogram() on /select/logsql/stats_query and /select/logsql/stats_query_range endpoints .
I am trying subquery
This query executes fine on type=raw and fails on type=instant and type=range. (even if I remove the by (...))
_stream:{log.syslog.hostname in (*),fgt.vd in (*),fgt.type="traffic",fgt.subtype="forward",fgt.policytype="policy",network.direction in ("outbound"),fgt.logid!=0000000020}
| fgt.action:in("accept","client-rst","close","dns","ip-conn","server-rst","start","timeout") AND * AND network.bytes:*
| source.ip:in(
#172.24.144.34
_stream:{log.syslog.hostname in (*),fgt.vd in (*),fgt.type="traffic",fgt.subtype="forward",fgt.policytype="policy",network.direction in ("outbound"),fgt.logid!=0000000020}
| fgt.action:in("accept","client-rst","close","dns","ip-conn","server-rst","start","timeout") AND * AND network.bytes:*
| top 5 (source.ip)
| keep source.ip
)
| stats by(source.ip) histogram(network.bytes)
type=raw
type=instant
