Help : Queries : Event Counts

The form is accessed from the Query>Other>Event Counts menu. The events query returns the most recent events using the URL /its/query/Events?action=count. The following arguments are recognized:

type

Filter on the type field in an event.

severity

Filter on the severity field in an event.

name

Filter on the name field in an event.

value

Filter on the value field in an event.

address

Filter on the address field in an event.

interface

Filter on the interface field in an event.

enterprise

Filter on the enterprise field in an event.

site

Filter on the site field in an event.

zone

Filter on the zone field in an event.

subnet

Filter on the subnet field in an event.

agent

Filter on the agent field in an event.

port

Filter on the port field in an event.

TZ

The time zone used to interpret dates, times, days of week and hours. It is also the time zone used when returning date and time information in results.

Currently recognized time zones are:

ID Name Offset from GMT
server Time zone of the Traffic Server  
AET Australia Eastern Time 10
AGT Argentina Standard Time -3
ART (Arabic) Egypt Standard Time 2
AST Alaska Standard Time -9
BET Brazil Eastern Time -3
BST Bangladesh Standard Time 6
CAT Central African Time -1
CST Central Standard Time -6
CTT China Standard Time 8
EAT Eastern African Time 3
ECT European Central Time 1
EET Eastern European Time 1
EST Eastern Standard Time -5
GMT Greenwich Mean Time 0
HST Hawaii Standard Time -10
IET Indiana Eastern Standard Time -5
JST Japan Standard Time 9
MIT Midway Islands Time -11
MST Mountain Standard Time -7
NET Near East Time 4
NST New Zealand Standard Time 12
PLT Pakistan Lahore Time 5
PNT Phoenix Standard Time -7
PST Pacific Standard Time -8
SST Solomon Standard Time 11
VST Vietnam Standard Time 7

Note: If the time zone is unspecified, it defaults to server.

date

Dates and times are specified in the following formats:

yyyymmdd Includes all the hours in the specified date.
yyyymmddhh Includes a specific hour.
today All hours from midnight to current hour.
yesterday All hours yesterday.
thisWeek All hours from Midnight Sunday to current hour.
lastWeek All hours last week.
thisMonth All hours from start of month to current hour.
lastMonth All hours last month.
lastHour Last hour.
last24Hours Last 24 hours.
last7Days Last 7 days to current hour.
last30Days Last 30 days to current hour.

Times and dates are interpreted in conjunction with the selected time zone (see TZ).

Dates can be combined in a list or specified as ranges, for example:

date=19990901,19990905-1999091212

would include all the hours on 1-Sep-1999 and all the hours between midnight 5-Sep-1999 and noon 12-Sep-1999.

If the argument is omitted, then the hours since midnight today will be used.

day

The days of the week to include in the result. The values are:

1 Sunday
2 Monday
3 Tuesday
4 Wednesday
5 Thursday
6 Friday
7 Saturday

Days can be listed or included in ranges

date=2-6 Include only workdays (Mon-Fri).
date=7-1 Include only weekend days (Sat-Sun).
date=3,5 Include only Tuesdays and Thursdays.

Days are interpreted in conjunction with the selected time zone (see TZ).

hour

The hours in the day to include. Hours are specified by the start of the hour (i.e. 0 = midnight to 1am and 23 = 11pm to midnight).

Hours can be included in lists, or in ranges.

hour=9-16 Work hours (9am to 5pm).
hour=17-8 Non-work hours (5pm to 9am)
hour=12,13 Lunch (Noon and 1pm hours)

Hours are interpreted in conjunction with the selected time zone (see TZ).

groupPeriod

Create a time series using the specified grouping period. Recognized periods include:

  • hour
  • day
  • week
  • month

Leave blank or omit argument in order to aggregate over entire interval.

Intervals are interpreted in conjunction with the selected time zone (see TZ).

resultField

Results returned as a table containing whichever columns were requested using resultField.

Category Field Description
Key Field time The time at the start of the interval.
seconds The time at the start of the interval in seconds since 1 Jan 1970 GMT.
server The address of the Traffic Server generating the event.
severity The severity of the event.
name The name of the event.
value Value associated with this event type.
address IP of agent being reported on.
interface Interface on agent being reported on.
url URL providing additional information for event.
comment Comment describing event.
enterprise The enterprise name associated with the event.
site The site name associated with the event.
zone The zone name associated with the event.
subnet The subnet name associated with the event.
agent The agent name associated with the event.
port The port name associated with the event.
Value Field events Number of frames in interval for given keys.

If key fields are omitted, then the result will be aggregated, ensuring that each row represents a unique combination of keys.

Result fields are specified as a list of field names. For example,

resultField=zone,events would return a table with the specified columns.

name

Filter on the name field in an event.

resultFormat

The following result formats are recognized:

  • csv Returns a plain text table of results with each field separated by a comma.
  • html Returns a formatted html table of results.
  • debug Returns an html table containing the argument list, as well as a separate result table. Also provides a means of viewing error messages relating to improperly constructed queries.

resultTruncate

Specify the number of rows to return in the result table. A truncation value is usually specified in conjunction with resultSort to generate a top N table. For example,

resultSort=frames&resultTruncate=10 would return the top 10 entries sorted by frames.

Leave blank if no truncation is required and all results should be returned.