Artifactory cloud comes with some canned queries.
This query aggregates download volume by repo:
_sourceCategory=artifactory*
| where _sourceCategory matches "*artifactory/traffic"
| parse regex "(?<year>\d{4})(?<month>\d{2})(?<day>\d{2})(?<hour>\d{2})(?<minute>\d{2})(?<second>\d{2})\|\d*\|(?<direction>[^|]*)\|\s*(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[^|]*)\|(?<repo>[^:]*):(?<fullfilepath>[^|]*)\|(?<size>\d*)" nodrop
| where direction matches "DOWNLOAD"
| sum(size) by repo
| _sum / (1024 * 1024 * 1024) as sizeinGB
| fields -_sum
| sort by sizeinGB | limit 10
This query aggregates data transfer over time:
_sourceCategory=artifactory*
| where _sourceCategory matches "*artifactory/traffic"
| parse regex "(?<year>\d{4})(?<month>\d{2})(?<day>\d{2})(?<hour>\d{2})(?<minute>\d{2})(?<second>\d{2})\|\d*\|(?<direction>[^|]*)\|\s*(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[^|]*)\|(?<repo>[^:]*):(?<fullfilepath>[^|]*)\|(?<size>\d*)" nodrop
| where direction matches "DOWNLOAD"
| timeslice 1h
| sum(size) by _timeslice, direction
| _sum / (1024 * 1024 * 1024) as sizeinGB | sort by _sum
| fields -_sum
| transpose row _timeslice column direction
I'm trying to combine the two to get GB downloaded over time aggregated by repo, but I cannot figure out how to do this. It looks like I have all the info I need in the query but cannot find the right syntax.
I tried to add a timeslice to the query that sums download size by repo but I get
Field timeslice not found, please check the spelling and try again.
_sourceCategory=artifactory*
| where _sourceCategory matches "*artifactory/traffic"
| parse regex "(?<year>\d{4})(?<month>\d{2})(?<day>\d{2})(?<hour>\d{2})(?<minute>\d{2})(?<second>\d{2})\|\d*\|(?<direction>[^|]*)\|\s*(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[^|]*)\|(?<repo>[^:]*):(?<fullfilepath>[^|]*)\|(?<size>\d*)" nodrop
| timeslice 1h
| sum(size) by repo
| _sum / (1024 * 1024 * 1024) as sizeinGB
| fields -_sum
| sort by sizeinGB | limit 100
| sort by timeslice
