Skip to content

Could not do instant query with histogram() #524

@arturminchukov

Description

@arturminchukov

Created from comment.

There still seems to be an issue with histogram() on /select/logsql/stats_query and /select/logsql/stats_query_range endpoints .

I am trying subquery

This query executes fine on type=raw and fails on type=instant and type=range. (even if I remove the by (...))

_stream:{log.syslog.hostname in (*),fgt.vd in (*),fgt.type="traffic",fgt.subtype="forward",fgt.policytype="policy",network.direction in ("outbound"),fgt.logid!=0000000020}
| fgt.action:in("accept","client-rst","close","dns","ip-conn","server-rst","start","timeout") AND * AND network.bytes:*
| source.ip:in(
    #172.24.144.34
    _stream:{log.syslog.hostname in (*),fgt.vd in (*),fgt.type="traffic",fgt.subtype="forward",fgt.policytype="policy",network.direction in ("outbound"),fgt.logid!=0000000020}
    | fgt.action:in("accept","client-rst","close","dns","ip-conn","server-rst","start","timeout") AND * AND network.bytes:*
    | top 5 (source.ip)
    | keep source.ip
  )

| stats by(source.ip) histogram(network.bytes)

type=raw

Image

type=instant

Image

Metadata

Metadata

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions