Query Loading editor...

Quick Reference

Show standard columns for the most recent occurrences of item #1:

FROM item_occurrence
WHERE item.counter = 1
ORDER BY timestamp DESC

For all occurrences of item #840 in the last 24 hours, group by request.user_ip; then show the total count, number that have server.host set, average value of body.message.seconds, and most recent timestamp; order by total count descending; and limit to the top 100 rows:

SELECT request.user_ip, count(*), count(server.host), avg(body.message.seconds), max(timestamp)
FROM item_occurrence
WHERE item.counter = 840
  AND timestamp > unix_timestamp() - 60 * 60 * 24
GROUP BY request.user_ip
ORDER BY count(*) DESC

Getting Help

General question? Please ask! If you're not sure how to get the data you want, we will be happy to help you write the query.
Find a problem? Let us know! If you run into a blocker or find a bug, we'd love to hear it.