Hello @yosiasz
I was able to achieve the result and create 3 columns writing below UQL query, however now I also want to add a filter on top so I can filter out traffic according to the domain/vhost. I have added a variable and also able to see the list(values of hostnames), but it is not yet integrated with the GRAPH. What should I add in the UQL query to make it happen? can you help?
===
parse-json scope “vhost”
project kv()
extend “sent_bytes”=“value.metrics.sent_bytes”
mv-expand “sent_bytes”
extend “vhost_name”=“key”
extend “Time”=unixtime_seconds_todatetime(“sent_bytes[0]”)
extend “bytes”=“sent_bytes[1]”
project “vhost_name”, “Time”, “bytes”
Attaching screenshots and Hiding hostnames for confidentiality
Can you help me how can I integrate the variable with the data? Currently selecting the variable doesn’t work.
@yosiasz
With command below I am able to capture an aggregated traffic for all hostnames, yet not able to filter graph according to selection. can you please suggest further?
summarize “bytes”=sum(“bytes”) by “time”, “$vhost_name”
Did you look at the docu and see how to filter? What have you tried from the docu
I am using below query so I can filter out graph per vhost and also make a aggregated graph if I use “All” filter. can you help. I think the logic I am using is correct but not the syntax.
@yosiasz
Query
parse-json
scope “vhost”
project kv()
extend “sent_bytes”=“value.metrics.sent_bytes”
mv-expand “sent_bytes”
extend “vhost_name”=“key”
extend “time”=unixtime_seconds_todatetime(“sent_bytes[0]”)
extend “bytes”=“sent_bytes[1]”
| extend “selected_vhost”=iif(‘${vhost_var}’==‘All’,‘All’,“vhost_name”)
| where “selected_vhost”==‘All’ or “vhost_name”==‘${vhost_var}’
| summarize “total_bytes”=sum(“bytes”) by “time”, “selected_vhost”
| project “selected_vhost”, “time”, “total_bytes”
