Data count order by

Fluxlang
1

Hello.
I am new to this.

I have a pretty simple issue but cant solve it. I am getting data from my firewall directly into InfluxDB.

Data structure:
timestamp, country, country_short, city, destIP, sourceIP, destPort, sourcePort, and more

Now I am looking for the count of rows by country during the given dashboard time frame. I would like to know how many connection I had during the given timeframe per country.
Later I would like to use this in a pie chart.

result should look like:

country, count
US 100
CN 10
UK 50

and so on. Without any timestamps.

I tried a lot but I cant get this to work.

Example:
data = from(bucket:“mybucket”)
|> range(start: -30m)
data
|> group(columns: [“country”], mode: “by”)
|> count()

but the result is just:
_start Value
2020-11-02 17:23:57 123456

Any suggestions?
Thanks a lot in advance.

2

Hello @steffenalex,
Welcome!
Hmm I’m not sure. Is there anyway you can export some of your data, so that I can try it? Alternatively, can you please take screens shots of the raw data view for your data before and after your flux transformation please?

3

Hello.

Thanks for your answer.
Here are the screenshots.

Screenshot 1 is the raw data which I believe is important for my problem
Screenshot 2 is the flux transformation I used
Screenshot 3 is the table of the result of the code used in 2.
Screenshot 4 is the code in my original post, just the count of entries.

Please note, that the 23 in each row is false and doesn’t reflect reality.

post_pic1
post_pic11834Ă—583 87.3 KB

post_pic2

post_pic3
post_pic31843Ă—720 64.1 KB

post_pic4
post_pic41845Ă—802 67.1 KB

1 Like
4

I’m not sure this is odd. The final query you show in screen shot 3 should be correct. I’m sharing this with the flux team in case they have any answers. Otherwise you might consider submitting a bug or asking on the grafana community.
Finally, can you check that your column name doesn’t have any trailing or leading white spaces?

5

Hello.
Thanks a lot for your help.
I will try to post this in the Grafana community. I am guessing they might say, since this seems to be a flux issue to come here.

I checked for white spaces and anything out of the ordinary but I was not able to find anything. So we are good here and there seems to be a deeper issue.

1 Like
6

I think for what you are doing this query is what you are looking for. But, you might want to try changing the column name. I think your column name might be AccessBlock.country rather than just country. Your results seem to be consistent with that.

from(bucket:“mybucket”)
|> range(start: -30m)
|> group(columns: [“AccessBlock.country”], mode: “by”)
|> count()
1 Like