完善

author: 姜鹏辉 <[email protected]> 2021-07-14 17:29:32 +0800
committer: 姜鹏辉 <[email protected]> 2021-07-14 17:35:42 +0800
commit: 267a22340447b5fe50b11baeb3e3291900595f98 (patch)
tree: 4449d73408665f2e27ba1b979fe03dc96f1064d9
parent: 302d49453c90c859898329ce3f800e0ca08a872f (diff)
10 files changed, 210 insertions, 1340 deletions
diff --git a/README.md b/README.md
index 0079464..e2a5769 100644
--- a/README.md
+++ b/README.md
@@ -1,17 +1,13 @@
-
+# POC测试-xj
 
 在OpenLookeng上执行POC测试
-<https://docs.mesalab.cn/display/DataVirtualizationEngine-
-
-
-
+<https://docs.mesalab.cn/pages/viewpage.action?pageId=19860345>
 
 ### 目录结构
 
 ```
 - install.sh         # 依赖安装脚本 （基于新疆环境,python2.7）
 - run.sh             # 测试脚本
-- require
 > log 日志目录
   - install.log      # 安装日志
   - ch-result.log    # ClickHouse运行统计日志
@@ -26,12 +22,31 @@
   - run.py           # python自动化测试脚本
   - convert_sql.py   # 根据poc-ch.json生成openlookeng语法的测试集
 > whl                # 离线安装包目录
-  - clickhouse_driver-0.1.2-cp27-cp27m-manylinux1_x86_64.whl
   - clickhouse_driver-0.1.2-cp27-cp27mu-manylinux1_x86_64.whl
   - clickhouse_driver-0.2.1-cp35-cp35m-manylinux1_x86_64.whl
   - requests_toolbelt-0.9.1-py2.py3-none-any.whl
 ```
 
+## 安装依赖
+Python 2环境
+```
+pip install ./whl/clickhouse_driver-0.1.2-cp27-cp27mu-manylinux1_x86_64.whl
+pip install ./whl/requests_toolbelt-0.9.1-py2.py3-none-any.whl
+```
+
+Python 3环境
+```
+pip install ./whl/clickhouse_driver-0.2.1-cp35-cp35m-manylinux1_x86_64.whl
+pip install ./whl/requests_toolbelt-0.9.1-py2.py3-none-any.whl
+```
+
+## 执行方式
+```
+./run.sh
+```
+等待执行完成后，将自动生成`log.tgz`压缩包，为各种日志的打包
+
+
 ## Todo
 
 - csv文件下载失败
diff --git a/log/ol-2021-07-09-17-33-36.json b/log/ol-2021-07-09-17-33-36.json
deleted file mode 100644
index 0903b06..0000000
--- a/log/ol-2021-07-09-17-33-36.json
+++ /dev/null
@@ -1,1283 +0,0 @@
-{
-    "pre": {
-        "sql": "use tsg_galaxy_v3",
-        "used_time": 0.007980000000000001
-    },
-    "Q1": {
-        "sql": "SELECT count(1) from connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00')",
-        "used_time": 0.13709
-    },
-    "Q2": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') LIMIT 30",
-        "used_time": 0.47796
-    },
-    "Q3": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.27
-    },
-    "Q4": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time asc LIMIT 30",
-        "used_time": 1.29
-    },
-    "Q5": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.31601
-    },
-    "Q6": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.46153
-    },
-    "Q7": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_internal_ip='223.116.37.192' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.40108
-    },
-    "Q8": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.08
-    },
-    "Q9": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_external_ip='111.10.53.14' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.40498
-    },
-    "Q10": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_port=52607 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.61524
-    },
-    "Q11": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_port=443 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.4
-    },
-    "Q12": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_c2s_pkt_num>5 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.51
-    },
-    "Q13": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_s2c_pkt_num>5 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.56
-    },
-    "Q14": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_c2s_byte_num>100 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.73
-    },
-    "Q15": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_s2c_byte_num<200 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.65
-    },
-    "Q16": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_schema_type='DNS' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.37
-    },
-    "Q17": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_establish_latency_ms>200 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.38
-    },
-    "Q18": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_con_duration_ms>10000 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.4
-    },
-    "Q19": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.43394
-    },
-    "Q20": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_tcp_client_isn=2857077935 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.37579
-    },
-    "Q21": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_tcp_server_isn=0 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.53
-    },
-    "Q22": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.96211
-    },
-    "Q23": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND mail_account='[email protected]' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.36206
-    },
-    "Q24": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND mail_subject='test' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.43868
-    },
-    "Q25": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND dns_qname='qbwup.imtt.qq.com' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.36743000000000003
-    },
-    "Q26": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.43854000000000004
-    },
-    "Q27": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_con_latency_ms>100 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.18
-    },
-    "Q28": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_ja3_hash='a0e9f5d64349fb13191bc781f81f42e1' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.56598
-    },
-    "Q29": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' and common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.9835900000000001
-    },
-    "Q30": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='111.10.53.14' and common_server_port=443 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.39396
-    },
-    "Q31": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND mail_account like 'abc@%' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.43647
-    },
-    "Q32": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.7076699999999999
-    },
-    "Q33": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.38982
-    },
-    "Q34": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.46476999999999996
-    },
-    "Q35": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_port not in (80,443) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.74
-    },
-    "Q36": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.31
-    },
-    "Q37": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.36
-    },
-    "Q38": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.09526000000000001
-    },
-    "Q39": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.20244
-    },
-    "Q40": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_internal_ip='223.116.37.192' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.22019
-    },
-    "Q41": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.20865
-    },
-    "Q42": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_external_ip='111.10.53.14' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.22103
-    },
-    "Q43": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_port=52607 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.12726
-    },
-    "Q44": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_port=443 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.41708
-    },
-    "Q45": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_c2s_pkt_num>5 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.7536900000000001
-    },
-    "Q46": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_s2c_pkt_num>5 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.45353
-    },
-    "Q47": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_c2s_byte_num>100 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 1.65
-    },
-    "Q48": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_s2c_byte_num<200 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 2.15
-    },
-    "Q49": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_schema_type='DNS' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.44014
-    },
-    "Q50": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_establish_latency_ms>200 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.38824000000000003
-    },
-    "Q51": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_con_duration_ms>10000 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 2.64
-    },
-    "Q52": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.14549
-    },
-    "Q53": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_tcp_client_isn=2857077935 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.11427
-    },
-    "Q54": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_tcp_server_isn=0 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 2.47
-    },
-    "Q55": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.17830000000000001
-    },
-    "Q56": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND mail_account='[email protected]' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.12283
-    },
-    "Q57": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND mail_subject='test' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.11985
-    },
-    "Q58": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND dns_qname='qbwup.imtt.qq.com' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.12695
-    },
-    "Q59": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.13737
-    },
-    "Q60": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_con_latency_ms>100 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.29123000000000004
-    },
-    "Q61": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_ja3_hash='a0e9f5d64349fb13191bc781f81f42e1' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.14195
-    },
-    "Q62": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' and common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.18922
-    },
-    "Q63": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='111.10.53.14' and common_server_port=443 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.21106999999999998
-    },
-    "Q64": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND mail_account like 'abc@%' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.12737
-    },
-    "Q65": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.13991
-    },
-    "Q66": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.12999000000000002
-    },
-    "Q67": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.19359
-    },
-    "Q68": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_port not in (80,443) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 2.05
-    },
-    "Q69": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.30738
-    },
-    "Q70": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 2.7
-    },
-    "Q71": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE from_unixtime(common_recv_time,'UTC+8') IN ( SELECT from_unixtime(common_recv_time,'UTC+8') FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30 ) AND common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 55.26
-    },
-    "Q72": {
-        "sql": "SELECT  *  FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30 ) AND common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 56.57
-    },
-    "Q73": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE from_unixtime(common_recv_time,'UTC+8') IN ( SELECT from_unixtime(common_recv_time,'UTC+8') FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30 ) AND common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 3.22
-    },
-    "Q74": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( select common_log_id FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00')) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 3.11
-    },
-    "Q75": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.25814
-    },
-    "Q76": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.31645999999999996
-    },
-    "Q77": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.33541000000000004
-    },
-    "Q78": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.23615
-    },
-    "Q79": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.24516
-    },
-    "Q80": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.31065
-    },
-    "Q81": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.19763999999999998
-    },
-    "Q82": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.21516
-    },
-    "Q83": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.22791999999999998
-    },
-    "Q84": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.17809999999999998
-    },
-    "Q85": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.26827999999999996
-    },
-    "Q86": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.42894
-    },
-    "Q87": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 3.25
-    },
-    "Q88": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.25841000000000003
-    },
-    "Q89": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.27802
-    },
-    "Q90": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.34414999999999996
-    },
-    "Q91": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.21599000000000002
-    },
-    "Q92": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.2801
-    },
-    "Q93": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.2764
-    },
-    "Q94": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.1895
-    },
-    "Q95": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.22807
-    },
-    "Q96": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.20404
-    },
-    "Q97": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.1992
-    },
-    "Q98": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.26435000000000003
-    },
-    "Q99": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.38391000000000003
-    },
-    "Q100": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 3.15
-    },
-    "Q101": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.19171000000000002
-    },
-    "Q102": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.29261000000000004
-    },
-    "Q103": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.2921
-    },
-    "Q104": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.19996
-    },
-    "Q105": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.20894
-    },
-    "Q106": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.24040999999999998
-    },
-    "Q107": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.19461
-    },
-    "Q108": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.17981999999999998
-    },
-    "Q109": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.22385
-    },
-    "Q110": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.17955000000000002
-    },
-    "Q111": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.27309
-    },
-    "Q112": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.39267
-    },
-    "Q113": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 3.22
-    },
-    "Q114": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.25616
-    },
-    "Q115": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.34006000000000003
-    },
-    "Q116": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.30954000000000004
-    },
-    "Q117": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.20414
-    },
-    "Q118": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.2275
-    },
-    "Q119": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.26546
-    },
-    "Q120": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.1933
-    },
-    "Q121": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.17586000000000002
-    },
-    "Q122": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.22254
-    },
-    "Q123": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.18174
-    },
-    "Q124": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.27979000000000004
-    },
-    "Q125": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 0.39874
-    },
-    "Q126": {
-        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
-        "used_time": 3.23
-    },
-    "Q127": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.36068
-    },
-    "Q128": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.46001
-    },
-    "Q129": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 1.35
-    },
-    "Q130": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.45011
-    },
-    "Q131": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.45512
-    },
-    "Q132": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 1.16
-    },
-    "Q133": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.45904
-    },
-    "Q134": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.46691000000000005
-    },
-    "Q135": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.75117
-    },
-    "Q136": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.46162000000000003
-    },
-    "Q137": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.49191
-    },
-    "Q138": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 2.57
-    },
-    "Q139": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 54.94
-    },
-    "Q140": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.35425
-    },
-    "Q141": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.48378
-    },
-    "Q142": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 1.39
-    },
-    "Q143": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.47247
-    },
-    "Q144": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.48531
-    },
-    "Q145": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 1.13
-    },
-    "Q146": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.49589
-    },
-    "Q147": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.45419
-    },
-    "Q148": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.75599
-    },
-    "Q149": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.4738
-    },
-    "Q150": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.4658
-    },
-    "Q151": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 2.58
-    },
-    "Q152": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 54.65
-    },
-    "Q153": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.37915
-    },
-    "Q154": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.50649
-    },
-    "Q155": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 1.38
-    },
-    "Q156": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.46901
-    },
-    "Q157": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.48901
-    },
-    "Q158": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 1.16
-    },
-    "Q159": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.43785
-    },
-    "Q160": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.43218
-    },
-    "Q161": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.78038
-    },
-    "Q162": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.46172
-    },
-    "Q163": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.48931
-    },
-    "Q164": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 2.4
-    },
-    "Q165": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 55.25
-    },
-    "Q166": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.35807
-    },
-    "Q167": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.50897
-    },
-    "Q168": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 1.35
-    },
-    "Q169": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.48512
-    },
-    "Q170": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.4929
-    },
-    "Q171": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 1.18
-    },
-    "Q172": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.38994999999999996
-    },
-    "Q173": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.41275
-    },
-    "Q174": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.74711
-    },
-    "Q175": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.40082
-    },
-    "Q176": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 0.4747
-    },
-    "Q177": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 2.45
-    },
-    "Q178": {
-        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
-        "used_time": 55.36
-    },
-    "Q179": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", count(common_log_id) AS \"logs\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.26406
-    },
-    "Q180": {
-        "sql": "SELECT from_unixtime(cast(common_recv_time/30 as int) * 30,'UTC+8') AS stat_time, sum(common_c2s_byte_num) AS bytes_sent, sum(common_s2c_byte_num) AS bytes_received, sum(common_c2s_byte_num + common_s2c_byte_num) AS bytes, sum(common_c2s_pkt_num + common_s2c_pkt_num) AS packets, sum(common_sessions) AS sessions FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') GROUP BY from_unixtime(cast(common_recv_time/30 as int) * 30,'UTC+8') ORDER BY stat_time ASC LIMIT 10000",
-        "used_time": 1.57
-    },
-    "Q181": {
-        "sql": "SELECT from_unixtime(cast(common_recv_time/300 as int) * 300,'UTC+8') AS stat_time, common_schema_type AS type, sum(common_sessions) AS sessions, sum(common_c2s_byte_num + common_s2c_byte_num) AS bytes, sum(common_c2s_pkt_num + common_s2c_pkt_num) AS packets FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') GROUP BY from_unixtime(cast(common_recv_time/300 as int) * 300,'UTC+8'), common_schema_type ORDER BY stat_time ASC LIMIT 10000",
-        "used_time": 1.68
-    },
-    "Q182": {
-        "sql": "SELECT round(sum(common_s2c_byte_num) * 8 / 300,2) AS trafficInBits, round(sum(common_c2s_byte_num) * 8 / 300,2) AS trafficOutBits, round(sum(common_s2c_byte_num + common_c2s_byte_num) * 8 / 300,2) AS trafficTotalBits, round(sum(common_s2c_pkt_num) / 300,2) AS trafficInPackets, round(sum(common_c2s_pkt_num) / 300,2) AS trafficOutPackets, round(sum(common_s2c_pkt_num + common_c2s_pkt_num) / 300,2) AS trafficTotalPackets, round(sum(common_sessions) / 300,2) AS sessions FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00')",
-        "used_time": 0.22853
-    },
-    "Q183": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", approx_distinct(common_internal_ip) AS \"Unique Internal IP\", approx_distinct(common_external_ip) AS \"Unique External IP\", approx_distinct(common_subscriber_id) AS \"Unique Subscriber ID\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 2.33
-    },
-    "Q184": {
-        "sql": "SELECT 'all' AS type, approx_distinct(common_client_ip) AS client_ips, approx_distinct(common_internal_ip) AS internal_ips, approx_distinct(common_server_ip) AS server_ips, approx_distinct(common_external_ip) AS external_ips, approx_distinct(common_subscriber_id) as subscriber_ids FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') UNION ALL SELECT 'tcp' AS type, approx_distinct(common_client_ip) AS client_ips, approx_distinct(common_internal_ip) AS internal_ips, approx_distinct(common_server_ip) AS server_ips, approx_distinct(common_external_ip) AS external_ips, approx_distinct(common_subscriber_id) as subscriber_ids FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_l4_protocol IN ( 'IPv4_TCP', 'IPv6_TCP' ) UNION ALL SELECT 'UDP' AS type, approx_distinct(common_client_ip) AS client_ips, approx_distinct(common_internal_ip) AS internal_ips, approx_distinct(common_server_ip) AS server_ips, approx_distinct(common_external_ip) AS external_ips, approx_distinct(common_subscriber_id) as subscriber_ids FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_l4_protocol IN ( 'IPv4_UDP', 'IPv6_UDP' )",
-        "used_time": 3.4
-    },
-    "Q185": {
-        "sql": "SELECT from_unixtime(cast(common_recv_time/300 as int) * 300,'UTC+8') AS stat_time, (CASE WHEN common_stream_dir = 1 THEN 'c2s' WHEN common_stream_dir = 2 THEN 's2c' WHEN common_stream_dir = 3 THEN 'double' ELSE 'None' END) AS type, sum(common_sessions) AS sessions FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') GROUP BY from_unixtime(cast(common_recv_time/300 as int) * 300,'UTC+8'), common_stream_dir ORDER BY stat_time ASC LIMIT 10000",
-        "used_time": 0.92944
-    },
-    "Q186": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(common_sessions) AS \"Sessions\", sum(if(common_stream_dir <> 3, common_sessions, 0)) AS \"one_side_sessions\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", round(one_side_sessions / sessions, 2) AS one_side_percent FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": -1,
-        "info": "State Failed: line 1:257: Column 'one_side_sessions' cannot be resolved"
-    },
-    "Q187": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(common_c2s_byte_num + common_s2c_byte_num) AS \"Bytes\", sum(common_c2s_tcp_lostlen + common_s2c_tcp_lostlen) AS \"gap_loss_bytes\", round(gap_loss_bytes / bytes, 2) AS gap_loss_percent FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( common_l4_protocol IN ( 'IPv4_TCP', 'IPv6_TCP' ) ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": -1,
-        "info": "State Failed: line 1:206: Column 'gap_loss_bytes' cannot be resolved"
-    },
-    "Q188": {
-        "sql": "SELECT \"server_ip\" AS \"server_ip\" , SUM(coalesce(\"Bytes\",0)) AS \"Bytes\" , SUM(coalesce(\"bytes_sent\",0)) AS \"Sent\" , SUM(coalesce(\"bytes_received\",0)) AS \"Received\" , SUM(coalesce(\"Sessions\",0)) AS \"Sessions\" FROM ( SELECT SUM(coalesce(common_c2s_byte_num,0)) AS \"bytes_sent\" , SUM(coalesce(common_s2c_byte_num,0)) AS \"bytes_received\" , SUM(common_c2s_byte_num+common_s2c_byte_num) AS \"Bytes\" , SUM(coalesce(common_sessions,0)) AS \"Sessions\" , common_server_ip AS \"server_ip\" FROM connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(common_server_ip)!= 0 ) GROUP BY common_server_ip ORDER BY \"Bytes\" desc ) GROUP BY \"server_ip\" ORDER BY \"Bytes\" desc LIMIT 30",
-        "used_time": 0.28597
-    },
-    "Q189": {
-        "sql": "SELECT common_client_ip , COUNT(*) AS sessions FROM connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') GROUP BY common_client_ip ORDER BY sessions desc LIMIT 30",
-        "used_time": 0.18028
-    },
-    "Q190": {
-        "sql": "SELECT \"Server Port\" AS \"Server Port\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT common_server_port AS \"Server Port\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( common_l4_protocol IN ( 'IPv4_TCP', 'IPv6_TCP' ) ) GROUP BY common_server_port LIMIT 1048576) GROUP BY \"Server Port\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.21816
-    },
-    "Q191": {
-        "sql": "SELECT \"domain\" AS \"Website Domain\" , SUM(coalesce(\"Bytes\",0)) AS \"Throughput\" FROM ( SELECT SUM(coalesce(common_c2s_byte_num,0)) AS \"bytes_sent\" , SUM(coalesce(common_s2c_byte_num,0)) AS \"bytes_received\" , SUM(coalesce(common_c2s_byte_num+common_s2c_byte_num,0)) AS \"Bytes\" , http_domain AS \"domain\" FROM connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain ORDER BY \"Bytes\" desc ) GROUP BY \"domain\" ORDER BY \"Throughput\" desc LIMIT 30",
-        "used_time": 0.18771000000000002
-    },
-    "Q192": {
-        "sql": "SELECT \"device_id\" AS \"device_id\", sum(coalesce(\"Bytes\", 0)) AS \"Bytes\", sum(coalesce(\"bytes_sent\", 0)) AS \"Sent\", sum(coalesce(\"bytes_received\", 0)) AS \"Received\" FROM (SELECT sum(coalesce(common_c2s_byte_num, 0)) AS \"bytes_sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"bytes_received\", sum(common_c2s_byte_num + common_s2c_byte_num) AS Bytes, common_device_id AS \"device_id\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY common_device_id ORDER BY \"Bytes\" DESC LIMIT 1048576) GROUP BY \"device_id\" ORDER BY \"Bytes\" DESC LIMIT 30",
-        "used_time": 0.20686000000000002
-    },
-    "Q193": {
-        "sql": "SELECT \"Http.Domain\" AS \"Http.Domain\", sum(coalesce(\"Client IP\", 0)) AS \"Client IP\" FROM (SELECT http_domain AS \"Http.Domain\", approx_distinct(common_client_ip) AS \"Client IP\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain ORDER BY \"Client IP\" DESC LIMIT 1048576) GROUP BY \"Http.Domain\" ORDER BY \"Client IP\" DESC LIMIT 30",
-        "used_time": 0.32426
-    },
-    "Q194": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", avg(coalesce(\"Avg Establish Latency(ms)\", 0)) AS \"Avg Establish Latency(ms)\" FROM (SELECT http_domain AS \"Domain\", avg(coalesce(common_establish_latency_ms, 0)) AS \"Avg Establish Latency(ms)\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Avg Establish Latency(ms)\" DESC LIMIT 100",
-        "used_time": 0.18961
-    },
-    "Q195": {
-        "sql": "SELECT \"source\" AS \"source\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT coalesce(nullif(common_subscriber_id, ''), nullif(common_client_ip, '')) AS \"source\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY coalesce(nullif(common_subscriber_id, ''), nullif(common_client_ip, '')) ORDER BY \"Sessions\" DESC LIMIT 1048576) GROUP BY \"source\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.28475
-    },
-    "Q196": {
-        "sql": "SELECT \"destination\" AS \"destination\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT coalesce(nullif(http_domain, ''), nullif(common_server_ip, '')) AS \"destination\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY coalesce(nullif(http_domain, ''), nullif(common_server_ip, '')) ORDER BY \"Sessions\" DESC LIMIT 1048576) GROUP BY \"destination\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.27279000000000003
-    },
-    "Q197": {
-        "sql": "SELECT \"server_location\" AS \"server_location\", sum(coalesce(\"Bytes\", 0)) AS \"Bytes\", sum(coalesce(\"bytes_sent\", 0)) AS \"Sent\", sum(coalesce(\"bytes_received\", 0)) AS \"Received\" FROM (SELECT arrayElement(splitByString(',', common_server_location), length(splitByString(',', common_server_location))) AS \"server_location\", sum(coalesce(common_c2s_byte_num, 0)) AS \"bytes_sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"bytes_received\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY \"server_location\" ORDER BY \"Bytes\" DESC LIMIT 1048576) GROUP BY \"server_location\" ORDER BY \"Bytes\" DESC LIMIT 30",
-        "used_time": -1,
-        "info": "State Failed: line 1:203: Function splitbystring not registered"
-    },
-    "Q198": {
-        "sql": "SELECT \"Http URL\" AS \"Http URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"Http URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY http_url LIMIT 1048576) GROUP BY \"Http URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.16047
-    },
-    "Q199": {
-        "sql": "SELECT \"server_ip\" AS \"server_ip\", groupUniqArray(coalesce(\"trans_app\", 0)) AS \"trans_app\", sum(coalesce(\"Bytes\", 0)) AS \"Bytes\", sum(coalesce(\"bytes_sent\", 0)) AS \"Sent\", sum(coalesce(\"bytes_received\", 0)) AS \"Received\" FROM (SELECT sum(coalesce(common_c2s_byte_num, 0)) AS \"bytes_sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"bytes_received\", sum(common_c2s_byte_num + common_s2c_byte_num) AS \"Bytes\", groupUniqArray(concat(common_l4_protocol, '/', toString(common_server_port))) AS \"trans_app\", common_server_ip AS \"server_ip\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(common_server_ip)!= 0 ) GROUP BY \"server_ip\" ORDER BY \"Bytes\" DESC LIMIT 1048576) GROUP BY \"server_ip\" ORDER BY \"Bytes\" DESC LIMIT 30",
-        "used_time": -1,
-        "info": "State Failed: line 1:455: Function tostring not registered"
-    },
-    "Q200": {
-        "sql": "SELECT \"Subscriber ID\" AS \"Subscriber ID\", \"Http.Domain\" AS \"Http.Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Http.Domain\", common_subscriber_id AS \"Subscriber ID\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(http_domain)!= 0 AND length(common_subscriber_id)!= 0 ) GROUP BY http_domain, common_subscriber_id ORDER BY \"Sessions\" DESC LIMIT 1048576) GROUP BY \"Subscriber ID\", \"Http.Domain\" ORDER BY \"Sessions\" DESC LIMIT 10000",
-        "used_time": 0.16269
-    },
-    "Q201": {
-        "sql": "SELECT \"Http.Domain\" AS \"Http.Domain\" , \"Server IP\" AS \"Server IP\" , SUM(coalesce(\"Bytes Sent\",0)) AS \"Bytes Sent\" FROM ( SELECT common_server_ip AS \"Server IP\" , http_domain AS \"Http.Domain\" , SUM(coalesce(common_c2s_byte_num+common_s2c_byte_num,0)) AS \"Bytes\" , SUM(coalesce(common_c2s_byte_num,0)) AS \"Bytes Sent\" , SUM(coalesce(common_s2c_byte_num,0)) AS \"Bytes Received\" FROM connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(http_domain)!= 0 ) GROUP BY common_server_ip , http_domain ORDER BY \"Bytes\" desc LIMIT 1048576 ) GROUP BY \"Http.Domain\" , \"Server IP\" ORDER BY \"Bytes Sent\" desc LIMIT 10000",
-        "used_time": 0.25604000000000005
-    },
-    "Q202": {
-        "sql": "SELECT \"Http.Domain\" AS \"Http.Domain\", \"Client IP\" AS \"Client IP\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT common_client_ip AS \"Client IP\", http_domain AS \"Http.Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(http_domain)!= 0 ) GROUP BY common_client_ip, http_domain ORDER BY \"Sessions\" DESC LIMIT 1048576) GROUP BY \"Http.Domain\", \"Client IP\" ORDER BY \"Sessions\" DESC LIMIT 10000",
-        "used_time": 0.23937999999999998
-    },
-    "Q203": {
-        "sql": "SELECT from_unixtime(cast(common_recv_time/300 as int) * 300,'UTC+8') AS _time , http_domain AS Domain, COUNT(DISTINCT(common_client_ip)) AS nums FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 AND http_domain IN ( SELECT http_domain FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 GROUP BY http_domain ORDER BY SUM(common_s2c_byte_num+common_c2s_byte_num) DESC LIMIT 5 ) GROUP BY from_unixtime(cast(common_recv_time/300 as int) * 300,'UTC+8') , http_domain ORDER BY from_unixtime(cast(common_recv_time/300 as int) * 300,'UTC+8') DESC LIMIT 10000",
-        "used_time": 0.34332
-    },
-    "Q204": {
-        "sql": "SELECT from_unixtime(cast(common_recv_time/3600 as int) * 3600,'UTC+8') AS stat_time , http_domain , approx_distinct(common_client_ip) AS nums FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00')-604800 AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain IN ( SELECT http_domain FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 GROUP BY http_domain ORDER BY COUNT(*) desc LIMIT 5 ) group by from_unixtime(cast(common_recv_time/3600 as int) * 3600,'UTC+8'), http_domain ORDER BY stat_time desc LIMIT 10000",
-        "used_time": 0.31811
-    },
-    "Q205": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", common_device_id AS \"Device ID\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY cast(common_recv_time/300 as int) * 300,common_device_id LIMIT 10000",
-        "used_time": 0.19402
-    },
-    "Q206": {
-        "sql": "SELECT \"Internal IP\" AS \"Internal IP\", \"Sled IP\" AS \"Sled IP\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT common_sled_ip AS \"Sled IP\", common_internal_ip AS \"Internal IP\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY common_sled_ip, common_internal_ip LIMIT 1048576) GROUP BY \"Internal IP\", \"Sled IP\" ORDER BY \"Sessions\" DESC LIMIT 10000",
-        "used_time": 0.27267
-    },
-    "Q207": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_log_id=1153021139190754263 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.11251
-    },
-    "Q208": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip='36.189.226.21' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.20513
-    },
-    "Q209": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_internal_ip='223.116.37.192' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.18125
-    },
-    "Q210": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_ip='8.8.8.8' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.231
-    },
-    "Q211": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_external_ip='111.10.53.14' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.19637000000000002
-    },
-    "Q212": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_port=52607 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.15869
-    },
-    "Q213": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_port=443 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.22385
-    },
-    "Q214": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_c2s_pkt_num>5 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.20392
-    },
-    "Q215": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_s2c_pkt_num>5 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.21084
-    },
-    "Q216": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_c2s_byte_num>100 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.22788999999999998
-    },
-    "Q217": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_s2c_byte_num<200 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.23088999999999998
-    },
-    "Q218": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_schema_type='DNS' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.22823
-    },
-    "Q219": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_establish_latency_ms>200 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.20681
-    },
-    "Q220": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_con_duration_ms>10000 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.24586000000000002
-    },
-    "Q221": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_stream_trace_id=1153021139190754263 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.14101
-    },
-    "Q222": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_tcp_client_isn=2857077935 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.14925
-    },
-    "Q223": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_tcp_server_isn=0 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.25838
-    },
-    "Q224": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain='microsoft.com' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.18921000000000002
-    },
-    "Q225": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_account='[email protected]' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.14707
-    },
-    "Q226": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_subject='test' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.13628
-    },
-    "Q227": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND dns_qname='qbwup.imtt.qq.com' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.1371
-    },
-    "Q228": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_sni='note.youdao.com' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.13369999999999999
-    },
-    "Q229": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_con_latency_ms>100 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.19569999999999999
-    },
-    "Q230": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_ja3_hash='a0e9f5d64349fb13191bc781f81f42e1' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.16922
-    },
-    "Q231": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip='36.189.226.21' and common_server_ip='8.8.8.8' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.23146
-    },
-    "Q232": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_ip='111.10.53.14' and common_server_port=443 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.22249000000000002
-    },
-    "Q233": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_account like 'abc@%' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.15214
-    },
-    "Q234": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain like '%baidu.com%' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.15527000000000002
-    },
-    "Q235": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_sni like '%youdao.com' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.13525
-    },
-    "Q236": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip in ('36.189.226.21','111.10.53.14') ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.21915
-    },
-    "Q237": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_port not in (80,443) ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.27605
-    },
-    "Q238": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND length(http_domain)!= 0 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.20987999999999998
-    },
-    "Q239": {
-        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain not like '%microsoft.com' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
-        "used_time": 0.25066
-    },
-    "Q240": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_log_id=1153021139190754263 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.12294
-    },
-    "Q241": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip='36.189.226.21' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.19090000000000001
-    },
-    "Q242": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_internal_ip='223.116.37.192' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.18803999999999998
-    },
-    "Q243": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_ip='8.8.8.8' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.18181
-    },
-    "Q244": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_external_ip='111.10.53.14' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.18450999999999998
-    },
-    "Q245": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_port=52607 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.14664
-    },
-    "Q246": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_port=443 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.18250999999999998
-    },
-    "Q247": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_c2s_pkt_num>5 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17697
-    },
-    "Q248": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_s2c_pkt_num>5 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17959
-    },
-    "Q249": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_c2s_byte_num>100 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.18586000000000003
-    },
-    "Q250": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_s2c_byte_num<200 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17545
-    },
-    "Q251": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_schema_type='DNS' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.16963
-    },
-    "Q252": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_establish_latency_ms>200 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.20604
-    },
-    "Q253": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_con_duration_ms>10000 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.18666
-    },
-    "Q254": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_stream_trace_id=1153021139190754263 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.13873
-    },
-    "Q255": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_tcp_client_isn=2857077935 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.1415
-    },
-    "Q256": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_tcp_server_isn=0 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17329
-    },
-    "Q257": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain='microsoft.com' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.16479
-    },
-    "Q258": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_account='[email protected]' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.15536000000000003
-    },
-    "Q259": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_subject='test' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.14683000000000002
-    },
-    "Q260": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND dns_qname='qbwup.imtt.qq.com' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17744
-    },
-    "Q261": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_sni='note.youdao.com' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17172
-    },
-    "Q262": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_con_latency_ms>100 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.18046
-    },
-    "Q263": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_ja3_hash='a0e9f5d64349fb13191bc781f81f42e1' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.18888999999999997
-    },
-    "Q264": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip='36.189.226.21' and common_server_ip='8.8.8.8' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.21543
-    },
-    "Q265": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_ip='111.10.53.14' and common_server_port=443 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.21233000000000002
-    },
-    "Q266": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_account like 'abc@%' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17218
-    },
-    "Q267": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain like '%baidu.com%' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.15352000000000002
-    },
-    "Q268": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_sni like '%youdao.com' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17839
-    },
-    "Q269": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip in ('36.189.226.21','111.10.53.14') ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.19256
-    },
-    "Q270": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_port not in (80,443) ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17643999999999999
-    },
-    "Q271": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND length(http_domain)!= 0 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.1601
-    },
-    "Q272": {
-        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain not like '%microsoft.com' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.16535
-    },
-    "Q273": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_log_id=1153021139190754263 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.11935
-    },
-    "Q274": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip='36.189.226.21' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.178
-    },
-    "Q275": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_internal_ip='223.116.37.192' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.21406999999999998
-    },
-    "Q276": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_ip='8.8.8.8' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.15094
-    },
-    "Q277": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_external_ip='111.10.53.14' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17652
-    },
-    "Q278": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_port=52607 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.14592
-    },
-    "Q279": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_port=443 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.173
-    },
-    "Q280": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_c2s_pkt_num>5 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17706
-    },
-    "Q281": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_s2c_pkt_num>5 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.16516999999999998
-    },
-    "Q282": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_c2s_byte_num>100 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17735
-    },
-    "Q283": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_s2c_byte_num<200 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17396999999999999
-    },
-    "Q284": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_schema_type='DNS' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.16879
-    },
-    "Q285": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_establish_latency_ms>200 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17419
-    },
-    "Q286": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_con_duration_ms>10000 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17778
-    },
-    "Q287": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_stream_trace_id=1153021139190754263 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.15115
-    },
-    "Q288": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_tcp_client_isn=2857077935 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.1351
-    },
-    "Q289": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_tcp_server_isn=0 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.166
-    },
-    "Q290": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain='microsoft.com' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.16513
-    },
-    "Q291": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_account='[email protected]' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.14577
-    },
-    "Q292": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_subject='test' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.13585
-    },
-    "Q293": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND dns_qname='qbwup.imtt.qq.com' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.16490000000000002
-    },
-    "Q294": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_sni='note.youdao.com' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.14649
-    },
-    "Q295": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_con_latency_ms>100 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.16341999999999998
-    },
-    "Q296": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_ja3_hash='a0e9f5d64349fb13191bc781f81f42e1' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.1674
-    },
-    "Q297": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip='36.189.226.21' and common_server_ip='8.8.8.8' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.20374
-    },
-    "Q298": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_ip='111.10.53.14' and common_server_port=443 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.19063
-    },
-    "Q299": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_account like 'abc@%' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.15414
-    },
-    "Q300": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain like '%baidu.com%' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.15148
-    },
-    "Q301": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_sni like '%youdao.com' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.13233
-    },
-    "Q302": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip in ('36.189.226.21','111.10.53.14') ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17523
-    },
-    "Q303": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_port not in (80,443) ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.18084999999999998
-    },
-    "Q304": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND length(http_domain)!= 0 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.17256
-    },
-    "Q305": {
-        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain not like '%microsoft.com' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
-        "used_time": 0.19968
-    },
-    "Q306": {
-        "sql": "SELECT \"Http.Domain\" AS \"Http.Domain\", sum(coalesce(\"Unique Client IP\", 0)) AS \"Unique Client IP\", sum(coalesce(\"Unique Subscriber ID\", 0)) AS \"Unique Subscriber ID\" FROM (SELECT http_domain AS \"Http.Domain\", approx_distinct(common_client_ip) AS \"Unique Client IP\", approx_distinct(common_subscriber_id) AS \"Unique Subscriber ID\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Http.Domain\" ORDER BY \"Unique Client IP\" DESC LIMIT 100",
-        "used_time": 0.3347
-    },
-    "Q307": {
-        "sql": "SELECT \"Http.Domain\" AS \"Http.Domain\", sum(coalesce(\"Packets Sent\", 0)) AS \"Packets Sent\" FROM (SELECT http_domain AS \"Http.Domain\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Http.Domain\" ORDER BY \"Packets Sent\" DESC LIMIT 100",
-        "used_time": 0.16021000000000002
-    },
-    "Q308": {
-        "sql": "SELECT \"Internal IP\" AS \"Internal IP\", \"External IP\" AS \"External IP\", \"Sled IP\" AS \"Sled IP\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT common_sled_ip AS \"Sled IP\", common_external_ip AS \"External IP\", common_internal_ip AS \"Internal IP\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes Sent+Bytes Received\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( common_stream_dir != 3 ) GROUP BY common_sled_ip, common_external_ip ,common_internal_ip LIMIT 1048576) GROUP BY \"Internal IP\", \"External IP\", \"Sled IP\" ORDER BY \"Sessions\" DESC LIMIT 500",
-        "used_time": 0.33824
-    },
-    "Q309": {
-        "sql": "SELECT \"Client ASN\" AS \"Client ASN\", \"Server ASN\" AS \"Server ASN\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT common_server_asn AS \"Server ASN\", common_client_asn AS \"Client ASN\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( common_stream_dir != 3 ) GROUP BY common_server_asn, common_client_asn LIMIT 1048576) GROUP BY \"Client ASN\", \"Server ASN\" ORDER BY \"Sessions\" DESC LIMIT 500",
-        "used_time": 0.25132
-    },
-    "Q310": {
-        "sql": "SELECT \"SSL.SNI\" AS \"SSL.SNI\", \"Client IP\" AS \"Client IP\", avg(coalesce(\"Establish Latency(ms)\", 0)) AS \"Establish Latency(ms)\" FROM (SELECT common_client_ip AS \"Client IP\", ssl_sni AS \"SSL.SNI\", avg(coalesce(common_establish_latency_ms, 0)) AS \"Establish Latency(ms)\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY common_client_ip, ssl_sni LIMIT 1048576) GROUP BY \"SSL.SNI\", \"Client IP\" ORDER BY \"Establish Latency(ms)\" DESC LIMIT 500",
-        "used_time": 0.25248
-    },
-    "Q311": {
-        "sql": "select  FROM_UNIXTIME(min(common_recv_time)) as \"First Seen\" , FROM_UNIXTIME(max(common_recv_time)) as \"Last Seen\" ,  median(http_response_lantency_ms) as \"Server Processing Time Median(ms)\", count(1) as Responses,any(common_server_location)  as Location from connection_record_log WHERE  common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00')  AND  http_domain='baidu.com'",
-        "used_time": -1,
-        "info": "State Failed: line 1:119: Function median not registered"
-    },
-    "Q312": {
-        "sql": "select common_client_ip as \"Client IP\" , avg(common_establish_latency_ms) as \"Establishing Time Mean(ms)\", count(1) as Responses,any(common_client_location) as Location from connection_record_log where  common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00')  and http_domain='baidu.com' group by \"Client IP\" order by Responses desc limit 100",
-        "used_time": -1,
-        "info": "State Failed: line 1:130: Function any not registered"
-    },
-    "Q313": {
-        "sql": "select common_server_ip as \"Server IP\" , avg(http_response_lantency_ms) as \"Server Processing Time Mean(ms)\", count(1) as Responses,any(common_server_location) as Location from connection_record_log where common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') and http_domain='baidu.com' group by \"Server IP\" order by Responses desc limit 100",
-        "used_time": -1,
-        "info": "State Failed: line 1:133: Function any not registered"
-    },
-    "Q314": {
-        "sql": "select http_url as \"URI\" , avg(http_response_lantency_ms) as \"Server Processing Time Mean(ms)\", count(1) as Responses from connection_record_log where  common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') and http_domain='baidu.com' group by http_url order by Responses desc limit 100",
-        "used_time": 0.12628
-    },
-    "Q315": {
-        "sql": "select  common_l7_protocol as \"Protocol\" , approx_distinct(common_client_ip) as \"Clients\" , approx_distinct(common_server_ip) as \"Servers\", count(1) as Sessions,sum(common_c2s_byte_num+common_s2c_byte_num)  as bytes from connection_record_log where common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') and length(common_l7_protocol)!= 0  group by common_l7_protocol  order by bytes desc",
-        "used_time": 1.44
-    },
-    "Q316": {
-        "sql": "select common_client_ip as \"Client IP\" , count(1) as Sessions,sum(common_c2s_byte_num) as \"Bytes Out\", sum(common_s2c_byte_num) as \"Bytes In\",any(common_client_location) as Location from connection_record_log where common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') and common_l7_protocol='SIP' group by \"Client IP\" order by Sessions desc limit 100",
-        "used_time": -1,
-        "info": "State Failed: line 1:143: Function any not registered"
-    },
-    "Q317": {
-        "sql": "select common_server_ip as \"Server IP\" , count(1) as Sessions,sum(common_c2s_byte_num) as \"Bytes Out\", sum(common_s2c_byte_num) as \"Bytes In\",any(common_server_location) as Location from connection_record_log where common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') and common_l7_protocol='SIP' group by \"Server IP\" order by Sessions desc limit 100",
-        "used_time": -1,
-        "info": "State Failed: line 1:143: Function any not registered"
-    }
-}
-\ No newline at end of file
diff --git a/run.sh b/run.sh
index d693018..4cad55b 100644
--- a/run.sh
+++ b/run.sh
@@ -1,9 +1,64 @@
-for i in {1,2,3}
-do
+
+#!/bin/bash
+systeminfologfile="./log/systeminfo.log"
+runtimelogfile="./log/runtime.log"
+
+collect_info(){
+    echo co
+    echo "--------" >> $systeminfologfile
+    echo "CPU INFO" >> $systeminfologfile
+    echo "--------" >> $systeminfologfile
+    lscpu >> $systeminfologfile 2>&1
+    echo "--------" >> $systeminfologfile
+    echo "MEM INFO" >> $systeminfologfile
+    echo "--------" >> $systeminfologfile
+    cat /proc/meminfo >> $systeminfologfile 2>&1
+    echo "--------" >> $systeminfologfile
+    echo "LINUX INFO" >> $systeminfologfile
+    echo "--------" >> $systeminfologfile
+    uname -a >> $systeminfologfile 2>&1
+}
+
+collect_use_info(){
+    echo "--------" >> $runtimelogfile
+    echo "MEM USE" >> $runtimelogfile
+    echo "--------" >> $runtimelogfile
+    free -g >> $runtimelogfile 2>&1
+    echo "--------" >> $runtimelogfile
+    echo "CPU USE" >> $runtimelogfile
+    echo "--------" >> $runtimelogfile
+    mpstat >> $runtimelogfile 2>&1
+}
+
+ch_test(){
+    echo 1 > /proc/sys/vm/drop_caches
+    collect_use_info
     echo "running ClickHouse test"
-    python ./src/run.py ch
+    python ./src/run.py ch $(pwd)
+}
+
+ol_test(){
     echo 1 > /proc/sys/vm/drop_caches
+    collect_use_info
     echo "running OpenLookeng test"
-    python ./src/run.py ol
-    echo 1 > /proc/sys/vm/drop_caches
-done
-\ No newline at end of file
+    python ./src/run.py ol $(pwd)
+}
+
+clear_log() {
+    rm -rf ./log/*
+    rm -rf ./src/__pycache__
+}
+
+start() {
+    clear_log
+    collect_info
+    for i in {1,2,3}
+    do
+        ch_test
+        ol_test
+    done
+    echo "finish poc test"
+    tar -zcvf log.tgz ./log
+}
+
+start
+\ No newline at end of file
diff --git a/src/auto-ol.json b/src/auto-ol.json
index 88569a4..614c563 100644
--- a/src/auto-ol.json
+++ b/src/auto-ol.json
@@ -1,5 +1,4 @@
 {
-    "pre": "use tsg_galaxy_v3",
     "Q1": "SELECT count(1) from connection_record_log WHERE common_recv_time >= to_unixtime(timestamp $time1) AND common_recv_time < to_unixtime(timestamp $time2)",
     "Q2": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp $time1) AND common_recv_time < to_unixtime(timestamp $time2) LIMIT 30",
     "Q3": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp $time1) AND common_recv_time < to_unixtime(timestamp $time2) ORDER BY common_recv_time DESC LIMIT 30",
diff --git a/src/config b/src/config
index 94983ec..b48f386 100644
--- a/src/config
+++ b/src/config
@@ -12,7 +12,6 @@ user = olk
 catalog = clickhouse223
 schema = tsg_galaxy_v3
 
-
 [clickhouse]
 host = 10.111.200.170
 port = 9001
@@ -27,8 +26,10 @@ user = olk
 catalog = clickhouselt
 schema = tsg_galaxy_v3
 
-
 [run]
 time1 = 2021-05-30 12:00:00
 time2 = 2021-06-30 12:00:00
-time_out = 1200
+time_out = 900  
+
+[optional]
+list_without_datetime = 1
+\ No newline at end of file
diff --git a/src/openlookeng_driver.py b/src/openlookeng_driver.py
index 1564cb6..67d2f6f 100644
--- a/src/openlookeng_driver.py
+++ b/src/openlookeng_driver.py
@@ -177,13 +177,15 @@ class WebResult:
         if csv_path is not None:
             if csv_name is None:
                 csv_name = csv_path.split('/')[-1]
-            response = requests.get(csv_path)
+            response = requests.get(csv_path,headers = self.client.headers)
             if response.status_code == 200:
                 content = response.content
-                with open(csv_name,'w') as file:
+                with open(csv_name,'wb') as file:
                     file.write(content)
+            else:
+                raise Exception("Download Error:status code: {}".format(response.status_code))
         else:
-            raise Exception("Download Error")
+            raise Exception("Download Error:csv_path none")
                         
 def print_csv(csv_path):
     response = requests.get(csv_path)
@@ -248,13 +250,16 @@ class Client:
         logger.info("connect to {}:{} user:{} catalog:{} schema:{}".format(self.host,self.port,self.user,self.catalog,self.schema))
         self.logger  = logger
 
-    def execute(self,sql):
+    def __execute(self,sql):
         sql = sql.split(';')[0]
         response = requests.post(self.execute_url,data = sql,headers = self.headers)
         if response.ok:
             return Result(json.loads(response.text)['nextUri'])
         else:
             return response.text
+
+    def execute(self,sql):
+        return self.web_execute(self,sql)
         
     def web_execute(self,sql):
         if ';' in sql:
@@ -303,8 +308,4 @@ if __name__ == "__main__":
     client = Client(host='192.168.40.152',port=18080,user='lk',catalog='clickhouse223',schema='tsg_galaxy_v3')
     client.add_logging(log_level=logging.DEBUG)
 
-    #result = client.web_execute("SELECT sum(LO_REVENUE),  year(LO_ORDERDATE) AS year,  P_BRAND  FROM lineorder_flat  WHERE P_CATEGORY = 'MFGR#12' AND S_REGION = 'AMERICA'  GROUP BY  year(LO_ORDERDATE),  P_BRAND  ORDER BY  year(LO_ORDERDATE),  P_BRAND LIMIT 3")
-    #result.get_output()
-    # web_ress = client.web_executes("select 1,2,3,4;select1")
-    # for w in web_ress:
-    #     w.get_output()
+
diff --git a/src/poc-ch.json b/src/poc-ch.json
index f4eb2e8..d6e9f87 100644
--- a/src/poc-ch.json
+++ b/src/poc-ch.json
@@ -71,7 +71,7 @@
     "Q69": "SELECT toDateTime(common_recv_time) AS common_recv_time , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toUnixTimestamp($time1) AND common_recv_time < toUnixTimestamp($time2) AND notEmpty(http_domain) ORDER BY common_recv_time DESC LIMIT 30",
     "Q70": "SELECT toDateTime(common_recv_time) AS common_recv_time , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toUnixTimestamp($time1) AND common_recv_time < toUnixTimestamp($time2) AND http_domain not like '%microsoft.com' ORDER BY common_recv_time DESC LIMIT 30",
     "Q71": "SELECT * FROM connection_record_log AS connection_record_log WHERE toDateTime(common_recv_time) IN ( SELECT toDateTime(common_recv_time) FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toUnixTimestamp($time1) AND common_recv_time < toUnixTimestamp($time2) ORDER BY common_recv_time DESC LIMIT 30 ) AND common_recv_time >= toUnixTimestamp($time1) AND common_recv_time < toUnixTimestamp($time2) ORDER BY common_recv_time DESC LIMIT 30",
-    "Q72": "SELECT  *  FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toUnixTimestamp($time1) AND common_recv_time < toUnixTimestamp($time2) ORDER BY common_recv_time DESC LIMIT 30 ) AND common_recv_time >= toUnixTimestamp($time1) AND common_recv_time < toUnixTimestamp($time2) ORDER BY common_recv_time DESC LIMIT 30",
+    "Q72": "SELECT  * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toUnixTimestamp($time1) AND common_recv_time < toUnixTimestamp($time2) ORDER BY common_recv_time DESC LIMIT 30 ) AND common_recv_time >= toUnixTimestamp($time1) AND common_recv_time < toUnixTimestamp($time2) ORDER BY common_recv_time DESC LIMIT 30",
     "Q73": "SELECT toDateTime(common_recv_time) AS common_recv_time , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE toDateTime(common_recv_time) IN ( SELECT toDateTime(common_recv_time) FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toUnixTimestamp($time1) AND common_recv_time < toUnixTimestamp($time2) ORDER BY toDateTime(common_recv_time) DESC LIMIT 30 ) AND common_recv_time >= toUnixTimestamp($time1) AND common_recv_time < toUnixTimestamp($time2) ORDER BY common_recv_time DESC LIMIT 30",
     "Q74": "SELECT toDateTime(common_recv_time) AS common_recv_time , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( select common_log_id FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toUnixTimestamp($time1) AND common_recv_time < toUnixTimestamp($time2) ORDER BY toDateTime(common_recv_time) DESC LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp($time1) AND common_recv_time < toUnixTimestamp($time2)) ORDER BY common_recv_time DESC LIMIT 30",
     "Q75": "SELECT toDateTime(common_recv_time) AS common_recv_time , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= toUnixTimestamp($time1) AND common_recv_time < toUnixTimestamp($time2) AND common_log_id=1153021139190754263 ORDER BY toDateTime(common_recv_time) DESC LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp($time1) AND common_recv_time < toUnixTimestamp($time2) AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
diff --git a/src/run.py b/src/run.py
index 733b884..ceafb0e 100644
--- a/src/run.py
+++ b/src/run.py
@@ -1,14 +1,17 @@
 # -*- coding: utf-8 -*-
 import clickhouse_driver
 import openlookeng_driver
-import json,time,logging,sys
+import json,time,logging,sys,os
 import configparser
+from sql_filter import *
 olconfig = {}
 chconfig = {}
 
 time1,time2 = '',''
 sql_timeout = 2000
-def change_sql(origin_sql):
+run_loc = './'
+datetime_flag = 0
+def change_sql(mode,origin_sql):
     changed_sql = origin_sql.replace("$time1","'" + time1 + "'").replace("$time2","'" + time2 + "'")
     return changed_sql
 
@@ -27,9 +30,10 @@ def run_ch(test_sql,now_time = '2021'):
     results = {}
     total_time = 0
     suc_num,fail_num = 0,0
+    client.execute("use tsg_galaxy_v3")
     for k,v in test_sql.items():
         result = {}
-        run_sql = change_sql(v)
+        run_sql = change_sql('ch',v)
         result['sql'] = run_sql
         try:
             used_time = execute_sql(client,run_sql)
@@ -40,23 +44,23 @@ def run_ch(test_sql,now_time = '2021'):
             result['data_num'] = 0
             result['info'] = ''
             suc_num += 1
-            print("running Q{} success , {}√，{}×".format(k,suc_num,fail_num))
+            print("running {} success , {}√，{}×".format(k,suc_num,fail_num))
         except Exception as e:
             result['used_time'] = -1
             result['data_num'] = -1
             result['info'] = str(e)
             fail_num += 1
-            print("running Q{} failed , {}√，{}×".format(k,suc_num,fail_num))
+            print("running {} failed  , {}√，{}×  {}".format(k,suc_num,fail_num,result['info'].replace('\n','')[:40]))
 
         results[k] = result
         try:
-            with open("../log/ch-"+now_time + ".json",'w') as file:
+            with open(run_loc + "../log/ch-"+now_time + ".json",'w') as file:
                 file.write(json.dumps(results))
         except Exception as e:
             print("error",e)
         try:
-            file = open("../log/ch-result.log","a+")
-            file.write("{} success num: {}  failed num: {} \n".format(now_time,suc_num,fail_num))
+            file = open(run_loc + "../log/ch-result.log","a+")
+            file.write("{} {} success num: {}  failed num: {} \n".format(k,now_time,suc_num,fail_num))
             file.close()
         except Exception as e:
             print(e)
@@ -70,70 +74,89 @@ def run_olk(test_sql,now_time = '2021'):
     results = {}
     total_time = 0
     suc_num,fail_num = 0,0
+    os.mkdir(run_loc + "../log/" + now_time)
     for k,v in test_sql.items():
         result = {}
-        run_sql = change_sql(v)
+        run_sql = change_sql('ol',v)
         result['sql'] = run_sql
         try:
             web_result = client.web_execute(run_sql)
             used_time = float(web_result.get_used_time(sql_timeout))  # second
-            web_result.download_csv("../log/"+str(k)+".csv")
+            #web_result.download_csv(run_loc + "../log/" + now_time + "/" + str(k)+".csv")
+            web_result.download_csv("{}../log/{}/{}.csv".format(run_loc,now_time,str(k)))
             total_time += used_time
             result['used_time'] = used_time
             result['data_num'] = 0
             suc_num += 1
-            print("running Q{} success , {}√，{}×".format(k,suc_num,fail_num))
+            print("running {} success , {}√，{}×".format(k,suc_num,fail_num))
         except Exception as e:
             result['used_time'] = -1
             result['data_num'] = 0
             result['info'] = str(e)
             fail_num += 1
-            print("running Q{} failed , {}√，{}×".format(k,suc_num,fail_num))
+            print("running {} failed  , {}√，{}× {}".format(k,suc_num,fail_num,result['info'].replace('\n','')[:40]))
         results[k] = result
         try:
-            file = open("../log/ol-" + now_time + ".json",'w')
+            file = open(run_loc + "../log/ol-" + now_time + ".json",'w')
             file.write(json.dumps(results))
             file.close()
         except Exception as e:
             print("error",e)
         try:
-            with open("../log/ol-result.log","a+") as file:
-                file.write("{} success num: {}  failed num: {} \n".format(now_time,suc_num,fail_num))
+            with open(run_loc + "../log/ol-result.log","a+") as file:
+                file.write("{} {} success num: {}  failed num: {} \n".format(k,now_time,suc_num,fail_num))
         except Exception as e:
             print(e)
     time.sleep(10)
 
 def ch_poc():
-    with open("poc-ch.json",'r') as file:
+    with open(run_loc + "poc-ch.json",'r') as file:
         now_time = get_current_time()
         poc = json.loads(file.read())
+        # temp solve datetime error issue
+        if (datetime_flag):
+            poc = test_exclude_toDateTime('ch',poc)
         run_ch(poc,now_time)
 
 def ol_poc():
-    with open("auto-ol.json",'r') as file:
+    with open(run_loc + "auto-ol.json",'r') as file:
         now_time = get_current_time()
         poc = json.loads(file.read())
+        if (datetime_flag):
+            poc = test_exclude_toDateTime('ol',poc)
         run_olk(poc,now_time)
 
 
 def read_conf():
-    global time1,time2,sql_timeout,olconfig,chconfig
+    global time1,time2,sql_timeout,olconfig,chconfig,run_loc,datetime_flag
+    # 指定根目录
+    if (len(sys.argv) == 3):
+        run_loc = sys.argv[2] + "/src/"
     config = configparser.ConfigParser()
-    config.read("config")
+    config.read(run_loc + "config")
+
     time1 = config.get("run","time1")
     time2 = config.get("run","time2")
-    sql_timeout = config.get("run","time_out")
-    chconfig['host'] = config.get("clickhouse","host")
-    chconfig['port'] = config.get("clickhouse","port")
-    chconfig['user'] = config.get("clickhouse","user")
-    chconfig['password'] = config.get("clickhouse","password")
-
-    olconfig['host'] = config.get("openlookeng","host")
-    olconfig['port'] = config.get("openlookeng","port")
-    olconfig['user'] = config.get("openlookeng","user")
-    olconfig['catalog'] = config.get("openlookeng","catalog")
-    olconfig['schema'] = config.get("openlookeng","schema")
+    
+    sql_timeout = config.get("run","time_out") # default 900s 15min
+
+    ch_sector = "clickhouse"
+    ol_sector = "openlookeng"
+
+    chconfig['host'] = config.get(ch_sector,"host")
+    chconfig['port'] = str(config.get(ch_sector,"port"))
+    chconfig['user'] = config.get(ch_sector,"user")
+    chconfig['password'] = str(config.get(ch_sector,"password"))
+
+    olconfig['host'] = config.get(ol_sector,"host")
+    olconfig['port'] = str(config.get(ol_sector,"port"))
+    olconfig['user'] = config.get(ol_sector,"user")
+    olconfig['catalog'] = config.get(ol_sector,"catalog")
+    olconfig['schema'] = config.get(ol_sector,"schema")
+    datetime_flag = config.get("optional","list_without_datetime")
 
+def check_connect():
+    pass
 
 if __name__ == "__main__":
     read_conf()
diff --git a/src/sql_filter.py b/src/sql_filter.py
new file mode 100644
index 0000000..d861ac7
--- /dev/null
+++ b/src/sql_filter.py
@@ -0,0 +1,59 @@
+# -*- coding: utf-8 -*-
+# toDateTime函数映射失败，暂时屏蔽
+def exclude_toDateTime(mode,sql):
+    keys = list(sql.keys())
+    if mode == "ch":
+        for key in keys:
+            if "toDateTime" in sql[key]:
+                sql.pop(key)
+    else:  # mode == "ol"
+        for key in keys:
+            if "from_unixtime" in sql[key]:
+                sql.pop(key)
+    return sql
+
+
+def test_exclude_toDateTime(mode,sql1):
+    run_keys = ['Q1', 'Q2', 'Q3', 'Q4', 'Q5', 'Q6', 
+                'Q7', 'Q8', 'Q9', 'Q10', 'Q11', 'Q12', 'Q13', 
+                'Q14', 'Q15', 'Q16', 'Q17', 'Q18', 'Q19', 'Q20',
+                 'Q21', 'Q22', 'Q23', 'Q24', 'Q25', 'Q26', 'Q27', 
+                 'Q28', 'Q29', 'Q30', 'Q31', 'Q32', 'Q33', 'Q34',
+                  'Q35', 'Q36', 'Q37', 'Q72', 'Q127', 'Q128', 'Q129',
+                   'Q130', 'Q131', 'Q132', 'Q133', 'Q134', 'Q135', 
+                   'Q136', 'Q137', 'Q138', 'Q139', 'Q140', 'Q141', 
+                   'Q142', 'Q143', 'Q144', 'Q145', 'Q146', 'Q147', 
+                   'Q148', 'Q149', 'Q150', 'Q151', 'Q152', 'Q153', 
+                   'Q154', 'Q155', 'Q156', 'Q157', 'Q158', 'Q159', 
+                   'Q160', 'Q161', 'Q162', 'Q163', 'Q164', 'Q165', 
+                   'Q166', 'Q167', 'Q168', 'Q169', 'Q170', 'Q171', 
+                   'Q172', 'Q173', 'Q174', 'Q175', 'Q176', 'Q177', 
+                   'Q178', 'Q179', 'Q182', 'Q183', 'Q184', 'Q186', 
+                   'Q187', 'Q188', 'Q189', 'Q190', 'Q191', 'Q192', 
+                   'Q193', 'Q194', 'Q195', 'Q196', 'Q197', 'Q198', 
+                   'Q199', 'Q200', 'Q201', 'Q202', 'Q205', 'Q206', 
+                   'Q207', 'Q208', 'Q209', 'Q210', 'Q211', 'Q212', 
+                   'Q213', 'Q214', 'Q215', 'Q216', 'Q217', 'Q218', 
+                   'Q219', 'Q220', 'Q221', 'Q222', 'Q223', 'Q224', 
+                   'Q225', 'Q226', 'Q227', 'Q228', 'Q229', 'Q230', 
+                   'Q231', 'Q232', 'Q233', 'Q234', 'Q235', 'Q236', 
+                   'Q237', 'Q238', 'Q239', 'Q240', 'Q241', 'Q242', 
+                   'Q243', 'Q244', 'Q245', 'Q246', 'Q247', 'Q248', 
+                   'Q249', 'Q250', 'Q251', 'Q252', 'Q253', 'Q254', 
+                   'Q255', 'Q256', 'Q257', 'Q258', 'Q259', 'Q260', 
+                   'Q261', 'Q262', 'Q263', 'Q264', 'Q265', 'Q266', 
+                   'Q267', 'Q268', 'Q269', 'Q270', 'Q271', 'Q272', 
+                   'Q273', 'Q274', 'Q275', 'Q276', 'Q277', 'Q278', 
+                   'Q279', 'Q280', 'Q281', 'Q282', 'Q283', 'Q284', 
+                   'Q285', 'Q286', 'Q287', 'Q288', 'Q289', 'Q290', 
+                   'Q291', 'Q292', 'Q293', 'Q294', 'Q295', 'Q296', 
+                   'Q297', 'Q298', 'Q299', 'Q300', 'Q301', 'Q302', 
+                   'Q303', 'Q304', 'Q305', 'Q306', 'Q307', 'Q308', 
+                   'Q309', 'Q310', 'Q311', 'Q312', 'Q313', 'Q314', 
+                   'Q315', 'Q316', 'Q317']
+    
+    keys = list(sql1.keys())
+    for key in keys:
+        if key not in run_keys:
+            sql1.pop(key)
+    return sql1
+\ No newline at end of file
diff --git a/whl/clickhouse_driver-0.1.2-cp27-cp27m-manylinux1_x86_64.whl b/whl/clickhouse_driver-0.1.2-cp27-cp27m-manylinux1_x86_64.whl
deleted file mode 100644
index 793dcd5..0000000
--- a/whl/clickhouse_driver-0.1.2-cp27-cp27m-manylinux1_x86_64.whl
+++ /dev/null
author	姜鹏辉 <[email protected]>	2021-07-14 17:29:32 +0800
committer	姜鹏辉 <[email protected]>	2021-07-14 17:35:42 +0800
commit	267a22340447b5fe50b11baeb3e3291900595f98 (patch)
tree	4449d73408665f2e27ba1b979fe03dc96f1064d9
parent	302d49453c90c859898329ce3f800e0ca08a872f (diff)