@@ -877,7 +877,7 @@ required_capability: subquery_in_from_command
877877FROM sample_data, (FROM k8s metadata _index) metadata _index
878878| WHERE @timestamp < "2024-05-10T00:01:00.000Z"
879879| KEEP _index, @timestamp, client.ip, event_duration, cluster, network.total_bytes_in, network.eth0.tx
880- | SORT _index, @timestamp
880+ | SORT _index, @timestamp, client.ip, cluster
881881;
882882
883883_index:keyword | @timestamp:datetime | client.ip:ip | event_duration:long | cluster:keyword | network.total_bytes_in:long | network.eth0.tx:integer
@@ -901,19 +901,19 @@ required_capability: subquery_in_from_command
901901FROM k8s-downsampled, (FROM sample_data metadata _index) metadata _index
902902| WHERE @timestamp <= "2024-05-09T23:30:00.000Z"
903903| KEEP _index, @timestamp, client.ip, event_duration, cluster, network.total_bytes_in, network.eth0.tx
904- | SORT _index, @timestamp
904+ | SORT _index, @timestamp, client.ip, cluster, network.total_bytes_in
905905;
906906
907907_index:keyword | @timestamp:datetime | client.ip:ip | event_duration:long | cluster:keyword | network.total_bytes_in:long | network.eth0.tx:keyword
908- k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.30 | null | qa | 1143 | null
909- k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.31 | null | qa | 363 | null
910- k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.33 | null | prod | 210 | null
911908k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.30 | null | prod | 285 | null
909+ k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.30 | null | qa | 1143 | null
910+ k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.30 | null | staging | 930 | null
912911k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.31 | null | prod | 1038 | null
912+ k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.31 | null | qa | 363 | null
913913k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.31 | null | qa | 1032 | null
914+ k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.33 | null | prod | 210 | null
914915k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.34 | null | staging | 821 | null
915916k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.34 | null | staging | 838 | null
916- k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.30 | null | staging | 930 | null
917917sample_data | 2023-10-23T12:15:03.360Z | null | 3450233 | null | null | null
918918sample_data | 2023-10-23T12:27:28.948Z | null | 2764889 | null | null | null
919919sample_data | 2023-10-23T13:33:34.937Z | null | 1232382 | null | null | null
@@ -930,21 +930,21 @@ required_capability: subquery_in_from_command
930930FROM k8s, (FROM k8s-downsampled metadata _index | WHERE @timestamp <= "2024-05-09T23:30:00.000Z") metadata _index
931931| WHERE @timestamp <= "2024-05-10T00:01:00.000Z"
932932| KEEP _index, @timestamp, client.ip, cluster, network.total_bytes_in, network.eth0.tx
933- | SORT _index, @timestamp
933+ | SORT _index, @timestamp, client.ip, cluster, network.total_bytes_in
934934;
935935
936936_index:keyword | @timestamp:datetime | client.ip:ip | cluster:keyword | network.total_bytes_in:long | network.eth0.tx:keyword
937937k8s | 2024-05-10T00:00:29.000Z | 10.10.20.34 | staging | 953 | null
938938k8s | 2024-05-10T00:00:33.000Z | 10.10.20.34 | staging | 1111 | null
939939k8s | 2024-05-10T00:00:51.000Z | 10.10.20.30 | prod | 278 | null
940940k8s | 2024-05-10T00:00:57.000Z | 10.10.20.30 | prod | 955 | null
941- k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.31 | prod | 1038 | null
942- k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.30 | staging | 930 | null
943- k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.34 | staging | 838 | null
944- k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.30 | qa | 1143 | null
945- k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.31 | qa | 1032 | null
946941k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.30 | prod | 285 | null
942+ k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.30 | qa | 1143 | null
943+ k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.30 | staging | 930 | null
944+ k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.31 | prod | 1038 | null
947945k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.31 | qa | 363 | null
946+ k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.31 | qa | 1032 | null
948947k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.33 | prod | 210 | null
949948k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.34 | staging | 821 | null
949+ k8s-downsampled | 2024-05-09T23:30:00.000Z | 10.10.20.34 | staging | 838 | null
950950;
0 commit comments