From 4a989e91cd20c27531cf3c26daad700f961e8613 Mon Sep 17 00:00:00 2001 From: dcpena Date: Tue, 17 Mar 2026 16:39:40 -0500 Subject: [PATCH 1/2] Added page of sample queries --- .../docs/log-explorer/example-queries.mdx | 132 ++++++++++++++++++ 1 file changed, 132 insertions(+) create mode 100644 src/content/docs/log-explorer/example-queries.mdx diff --git a/src/content/docs/log-explorer/example-queries.mdx b/src/content/docs/log-explorer/example-queries.mdx new file mode 100644 index 00000000000..642307bb341 --- /dev/null +++ b/src/content/docs/log-explorer/example-queries.mdx @@ -0,0 +1,132 @@ +--- +title: Example SQL queries +pcx_content_type: example +sidebar: + order: 4 +description: SQL queries for traffic, security, and performance analysis. +--- + +The following examples show practical SQL queries you can use with the `http_requests` dataset in Log Explorer. For the full list of supported SQL syntax, refer to [SQL queries supported](/log-explorer/sql-queries/). + +Adjust the date ranges in each example to match the time period you want to query. + +## Summarize CDN usage + +Get a high-level summary of total requests and data transfer for a specific time period. Results include total bytes transferred and conversions to megabytes and gigabytes. + +```sql +SELECT + COUNT(*) AS total_requests, + SUM(EdgeResponseBytes) AS total_data_transfer, + SUM(EdgeResponseBytes) / (1024.0 * 1024.0 * 1024.0) AS total_data_transfer_gb, + SUM(EdgeResponseBytes) / (1024.0 * 1024.0) AS total_data_transfer_mb +FROM + http_requests +WHERE + EdgeEndTimestamp >= '2026-02-01T00:00:00Z' + AND EdgeEndTimestamp <= '2026-02-08T23:59:59Z' +``` + +## Review distribution of security actions + +Understand how security actions, such as blocks and challenges, are distributed across your traffic and identify the most common security responses applied to requests. + +```sql +SELECT + SecurityAction, + COUNT(*) AS ActionCount +FROM http_requests +WHERE SecurityAction != 'unknown' + AND SecurityAction IS NOT NULL +GROUP BY SecurityAction +ORDER BY ActionCount DESC +``` + +## Find IPs that triggered challenges + +Identify the top client IP addresses and request URIs that triggered managed, JavaScript, or interactive challenges to investigate potential bot activity or targeted attacks. + +```sql +SELECT + ClientIP, + ClientRequestURI, + SecurityAction, + COUNT(*) AS Count +FROM http_requests +WHERE SecurityAction IN ('managed_challenge', 'jschallenge', 'challenge') +GROUP BY ClientIP, ClientRequestURI, SecurityAction +ORDER BY Count DESC +LIMIT 10 +``` + +## Find highest bandwidth consumers by URI + +Identify which request URIs consume the most bandwidth to pinpoint large assets or endpoints that drive the most data transfer. + +```sql +SELECT + ClientRequestURI, + SUM(EdgeResponseBytes) / (1024 * 1024) AS MegabytesTransferred +FROM http_requests +GROUP BY ClientRequestURI +ORDER BY MegabytesTransferred DESC +LIMIT 10 +``` + +## Analyze client round-trip time by country + +Analyze client TCP round-trip time (RTT) across different countries to identify regions with high latency that might benefit from additional optimization. + +```sql +SELECT + ClientCountry, + COUNT(*) AS requests, + AVG(ClientTCPRttMs) AS avg_rtt, + MIN(ClientTCPRttMs) AS min_rtt, + MAX(ClientTCPRttMs) AS max_rtt +FROM http_requests +WHERE date = '2026-03-04' + AND EdgeEndTimestamp >= '2026-03-04T00:00:00Z' + AND EdgeEndTimestamp <= '2026-03-04T23:59:59Z' + AND ClientTCPRttMs > 0 +GROUP BY ClientCountry +ORDER BY avg_rtt DESC +LIMIT 20 +``` + +## Summarize CDN traffic by cache status + +Break down traffic by cache status and measure the average time to first byte (TTFB) for each status to evaluate cache effectiveness and identify opportunities to improve cache hit ratios. + +```sql +SELECT + CacheCacheStatus, + COUNT(*) AS requests, + SUM(EdgeResponseBytes) AS total_bytes, + AVG(EdgeTimeToFirstByteMs) AS avg_ttfb +FROM http_requests +WHERE date = '2026-03-04' + AND EdgeEndTimestamp >= '2026-03-04T00:00:00Z' + AND EdgeEndTimestamp <= '2026-03-04T23:59:59Z' +GROUP BY CacheCacheStatus +ORDER BY requests DESC +``` + +## Find slowest paths by time to first byte + +Find request paths with the highest average time to first byte (TTFB), along with request counts and server error counts toidentify slow endpoints that may need optimization. + +```sql +SELECT + ClientRequestPath, + AVG(EdgeTimeToFirstByteMs) AS avg_ttfb, + COUNT(*) AS requests, + SUM(CASE WHEN EdgeResponseStatus >= 500 THEN 1 ELSE 0 END) AS errors +FROM http_requests +WHERE date = '2026-03-04' + AND EdgeEndTimestamp >= '2026-03-04T00:00:00Z' + AND EdgeEndTimestamp <= '2026-03-04T23:59:59Z' +GROUP BY ClientRequestPath +ORDER BY avg_ttfb DESC +LIMIT 10 +``` From e9e0c65eee7341eb2e94377aab29422a8f86df34 Mon Sep 17 00:00:00 2001 From: dcpena Date: Thu, 19 Mar 2026 09:15:04 -0500 Subject: [PATCH 2/2] Implemented David's feedback --- .../docs/log-explorer/example-queries.mdx | 36 +++++++++---------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/src/content/docs/log-explorer/example-queries.mdx b/src/content/docs/log-explorer/example-queries.mdx index 642307bb341..677b0e32ab6 100644 --- a/src/content/docs/log-explorer/example-queries.mdx +++ b/src/content/docs/log-explorer/example-queries.mdx @@ -22,9 +22,7 @@ SELECT SUM(EdgeResponseBytes) / (1024.0 * 1024.0) AS total_data_transfer_mb FROM http_requests -WHERE - EdgeEndTimestamp >= '2026-02-01T00:00:00Z' - AND EdgeEndTimestamp <= '2026-02-08T23:59:59Z' +WHERE {{ timeFilter }} ``` ## Review distribution of security actions @@ -50,13 +48,22 @@ Identify the top client IP addresses and request URIs that triggered managed, Ja SELECT ClientIP, ClientRequestURI, - SecurityAction, + SecurityActions, COUNT(*) AS Count FROM http_requests -WHERE SecurityAction IN ('managed_challenge', 'jschallenge', 'challenge') -GROUP BY ClientIP, ClientRequestURI, SecurityAction +WHERE {{ timeFilter }} + AND ( + ARRAY_CONTAINS(SecurityActions, 'challenge') + OR ARRAY_CONTAINS(SecurityActions, 'managedChallenge') + OR ARRAY_CONTAINS(SecurityActions, 'jsChallenge') + OR ARRAY_CONTAINS(SecurityActions, 'challengeSolved') + ) +GROUP BY + ClientIP, + ClientRequestURI, + SecurityActions ORDER BY Count DESC -LIMIT 10 +LIMIT 20 ``` ## Find highest bandwidth consumers by URI @@ -68,6 +75,7 @@ SELECT ClientRequestURI, SUM(EdgeResponseBytes) / (1024 * 1024) AS MegabytesTransferred FROM http_requests +WHERE {{ timeFilter }} GROUP BY ClientRequestURI ORDER BY MegabytesTransferred DESC LIMIT 10 @@ -85,10 +93,7 @@ SELECT MIN(ClientTCPRttMs) AS min_rtt, MAX(ClientTCPRttMs) AS max_rtt FROM http_requests -WHERE date = '2026-03-04' - AND EdgeEndTimestamp >= '2026-03-04T00:00:00Z' - AND EdgeEndTimestamp <= '2026-03-04T23:59:59Z' - AND ClientTCPRttMs > 0 +WHERE {{ timeFilter }} GROUP BY ClientCountry ORDER BY avg_rtt DESC LIMIT 20 @@ -105,9 +110,7 @@ SELECT SUM(EdgeResponseBytes) AS total_bytes, AVG(EdgeTimeToFirstByteMs) AS avg_ttfb FROM http_requests -WHERE date = '2026-03-04' - AND EdgeEndTimestamp >= '2026-03-04T00:00:00Z' - AND EdgeEndTimestamp <= '2026-03-04T23:59:59Z' +WHERE {{ timeFilter }} GROUP BY CacheCacheStatus ORDER BY requests DESC ``` @@ -123,10 +126,7 @@ SELECT COUNT(*) AS requests, SUM(CASE WHEN EdgeResponseStatus >= 500 THEN 1 ELSE 0 END) AS errors FROM http_requests -WHERE date = '2026-03-04' - AND EdgeEndTimestamp >= '2026-03-04T00:00:00Z' - AND EdgeEndTimestamp <= '2026-03-04T23:59:59Z' -GROUP BY ClientRequestPath +WHERE {{ timeFilter }} ORDER BY avg_ttfb DESC LIMIT 10 ```