Hello,
I’ve got InfluxDB populated with data from ntopng. I’ve got some data:
> show field keys from "asn:traffic"
name: asn:traffic
fieldKey fieldType
-------- ---------
bytes_rcvd float
bytes_sent float
> show tag keys from "asn:traffic"
name: asn:traffic
tagKey
------
asn
ifid
>
I can create a query to convert bytes to bps and plot the results for a particular ASN:
SELECT non_negative_derivative(mean("bytes_rcvd"), 1s) * 8 FROM "asn:traffic" WHERE ("asn" = '2906') AND $timeFilter GROUP BY time($__interval) fill(none)
Is it possible to dynamically determine top X ASNs based on bps and plot them, and their bps?
InfluxDB has TOP function for that.
Thanks! I have tried to use top() but I haven’t been able to produce the results that I’m after.
This query seems to get me closer to where I want to be, but there are no values for asn:
> select top(bps,asn,10) from (SELECT non_negative_derivative(mean(bytes_rcvd), 1s) * 8 as bps FROM "asn:traffic" WHERE time >= now() - 12h GROUP BY time(30s) fill(none))
name: asn:traffic
time top asn
---- --- ---
1550299860000000000 853572800
1550301660000000000 1197327200
1550301720000000000 1666883866.6666667
1550310780000000000 674889600
1550329320000000000 20979431866.666668
1550332740000000000 707015600
1550335920000000000 2066646533.3333333
1550336820000000000 618554933.3333334
1550339280000000000 669084933.3333334
1550340300000000000 704147333.3333334
>
I thought that maybe the sub query needs to select asn also, but that gives me an error about mixing queries:
> select top(bps,asn,10) from (SELECT asn, non_negative_derivative(mean(bytes_rcvd), 1s) * 8 as bps FROM "asn:traffic" WHERE time >= now() - 12h GROUP BY time(30s) fill(none))
ERR: mixing aggregate and non-aggregate queries is not supported
>
What I’m looking to do is create a Grafana graph that displays the same visualization as this, where the rates of the top x ASNs are displayed in the visualization: 
