Jfrog 云附带了一些预设查询。
此查询按 repo 聚合下载量：
_sourceCategory=artifactory*
| where _sourceCategory matches "*artifactory/traffic"
| parse regex "(?<year>\d{4})(?<month>\d{2})(?<day>\d{2})(?<hour>\d{2})(?<minute>\d{2})(?<second>\d{2})\|\d*\|(?<direction>[^|]*)\|\s*(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[^|]*)\|(?<repo>[^:]*):(?<fullfilepath>[^|]*)\|(?<size>\d*)" nodrop
| where direction matches "DOWNLOAD"
| sum(size) by repo
| _sum / (1024 * 1024 * 1024) as sizeinGB
| fields -_sum
| sort by sizeinGB | limit 10
此查询汇总了一段时间内的数据传输：
_sourceCategory=artifactory*
| where _sourceCategory matches "*artifactory/traffic"
| parse regex "(?<year>\d{4})(?<month>\d{2})(?<day>\d{2})(?<hour>\d{2})(?<minute>\d{2})(?<second>\d{2})\|\d*\|(?<direction>[^|]*)\|\s*(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[^|]*)\|(?<repo>[^:]*):(?<fullfilepath>[^|]*)\|(?<size>\d*)" nodrop
| where direction matches "DOWNLOAD"
| timeslice 1h
| sum(size) by _timeslice, direction
| _sum / (1024 * 1024 * 1024) as sizeinGB | sort by _sum
| fields -_sum
| transpose row _timeslice column direction
我正在尝试将两者结合起来，以便随着时间的推移通过 repo 聚合下载 GB，但我无法弄清楚如何做到这一点。看起来我在查询中有我需要的所有信息，但找不到正确的语法。
我试图在查询中添加一个时间片，通过 repo 对下载大小求和，但Field timeslice not found, please check the spelling and try again.出现错误：
_sourceCategory=artifactory*
| where _sourceCategory matches "*artifactory/traffic"
| parse regex "(?<year>\d{4})(?<month>\d{2})(?<day>\d{2})(?<hour>\d{2})(?<minute>\d{2})(?<second>\d{2})\|\d*\|(?<direction>[^|]*)\|\s*(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[^|]*)\|(?<repo>[^:]*):(?<fullfilepath>[^|]*)\|(?<size>\d*)" nodrop
| timeslice 1h
| sum(size) by repo
| _sum / (1024 * 1024 * 1024) as sizeinGB
| fields -_sum
| sort by sizeinGB | limit 100
| sort by timeslice