Data count order by

I am new to this.

I have a pretty simple issue but cant solve it. I am getting data from my firewall directly into InfluxDB.

Data structure:
timestamp, country, country_short, city, destIP, sourceIP, destPort, sourcePort, and more

Now I am looking for the count of rows by country during the given dashboard time frame. I would like to know how many connection I had during the given timeframe per country.
Later I would like to use this in a pie chart.

result should look like:

country, count
US 100
CN 10
UK 50

and so on. Without any timestamps.

I tried a lot but I cant get this to work.

data = from(bucket:“mybucket”)
|> range(start: -30m)
|> group(columns: [“country”], mode: “by”)
|> count()

but the result is just:
_start Value
2020-11-02 17:23:57 123456

Any suggestions?
Thanks a lot in advance.

Hello @steffenalex,
Hmm I’m not sure. Is there anyway you can export some of your data, so that I can try it? Alternatively, can you please take screens shots of the raw data view for your data before and after your flux transformation please?


Thanks for your answer.
Here are the screenshots.

Screenshot 1 is the raw data which I believe is important for my problem
Screenshot 2 is the flux transformation I used
Screenshot 3 is the table of the result of the code used in 2.
Screenshot 4 is the code in my original post, just the count of entries.

Please note, that the 23 in each row is false and doesn’t reflect reality.


1 Like

I’m not sure this is odd. The final query you show in screen shot 3 should be correct. I’m sharing this with the flux team in case they have any answers. Otherwise you might consider submitting a bug or asking on the grafana community.
Finally, can you check that your column name doesn’t have any trailing or leading white spaces?

Thanks a lot for your help.
I will try to post this in the Grafana community. I am guessing they might say, since this seems to be a flux issue to come here.

I checked for white spaces and anything out of the ordinary but I was not able to find anything. So we are good here and there seems to be a deeper issue.

1 Like

I think for what you are doing this query is what you are looking for. But, you might want to try changing the column name. I think your column name might be rather than just country. Your results seem to be consistent with that.

|> range(start: -30m)
|> group(columns: [“”], mode: “by”)
|> count()
1 Like