改进

10 files changed, 1354 insertions, 41 deletions

diff --git a/.gitignore b/.gitignore
index 327d6a0..c94ed69 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 *.log
 *.tgz
+__pycache__
\ No newline at end of file
diff --git a/README.md b/README.md
index b05fe76..0079464 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@
 ### 目录结构
 
 ```
-- install.sh         # 依赖安装脚本
+- install.sh         # 依赖安装脚本 （基于新疆环境,python2.7）
 - run.sh             # 测试脚本
 - require
 > log 日志目录
@@ -24,9 +24,15 @@
   - config           # 配置文件
   - openlookeng_driver.py  #openlookeng驱动文件
   - run.py           # python自动化测试脚本
+  - convert_sql.py   # 根据poc-ch.json生成openlookeng语法的测试集
 > whl                # 离线安装包目录
   - clickhouse_driver-0.1.2-cp27-cp27m-manylinux1_x86_64.whl
   - clickhouse_driver-0.1.2-cp27-cp27mu-manylinux1_x86_64.whl
   - clickhouse_driver-0.2.1-cp35-cp35m-manylinux1_x86_64.whl
   - requests_toolbelt-0.9.1-py2.py3-none-any.whl
-```
\ No newline at end of file
+```
+
+## Todo
+
+- csv文件下载失败
+- 结果的行数统计
\ No newline at end of file
diff --git a/log/ch-2021-07-02-19-34-16.json b/log/ch-2021-07-02-19-34-16.json
deleted file mode 100644
index d3c3205..0000000
--- a/log/ch-2021-07-02-19-34-16.json
+++ /dev/null
@@ -1 +0,0 @@
-{"Q1": {"sql": "SELECT count(1) from connection_record_log WHERE common_recv_time >= toUnixTimestamp('2021-05-30 12:00:00') AND common_recv_time < toUnixTimestamp('2021-06-30 12:00:00')", "used_time": 0.023772716522216797, "data_num": 0, "info": ""}}
\ No newline at end of file
diff --git a/log/ch-2021-07-02-19-35-12.json b/log/ch-2021-07-02-19-35-12.json
deleted file mode 100644
index 7474548..0000000
--- a/log/ch-2021-07-02-19-35-12.json
+++ /dev/null
@@ -1 +0,0 @@
-{"Q1": {"sql": "SELECT count(1) from connection_record_log WHERE common_recv_time >= toUnixTimestamp('2021-05-30 12:00:00') AND common_recv_time < toUnixTimestamp('2021-06-30 12:00:00')", "used_time": 0.02090907096862793, "data_num": 0, "info": ""}, "Q2": {"sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= toUnixTimestamp('2021-05-30 12:00:00') AND common_recv_time < toUnixTimestamp('2021-06-30 12:00:00') LIMIT 30", "used_time": 0.13411307334899902, "data_num": 0, "info": ""}}
\ No newline at end of file
diff --git a/log/ol-2021-07-09-17-33-36.json b/log/ol-2021-07-09-17-33-36.json
new file mode 100644
index 0000000..0903b06
--- /dev/null
+++ b/log/ol-2021-07-09-17-33-36.json
@@ -0,0 +1,1283 @@
+{
+    "pre": {
+        "sql": "use tsg_galaxy_v3",
+        "used_time": 0.007980000000000001
+    },
+    "Q1": {
+        "sql": "SELECT count(1) from connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00')",
+        "used_time": 0.13709
+    },
+    "Q2": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') LIMIT 30",
+        "used_time": 0.47796
+    },
+    "Q3": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.27
+    },
+    "Q4": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time asc LIMIT 30",
+        "used_time": 1.29
+    },
+    "Q5": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.31601
+    },
+    "Q6": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.46153
+    },
+    "Q7": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_internal_ip='223.116.37.192' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.40108
+    },
+    "Q8": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.08
+    },
+    "Q9": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_external_ip='111.10.53.14' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.40498
+    },
+    "Q10": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_port=52607 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.61524
+    },
+    "Q11": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_port=443 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.4
+    },
+    "Q12": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_c2s_pkt_num>5 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.51
+    },
+    "Q13": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_s2c_pkt_num>5 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.56
+    },
+    "Q14": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_c2s_byte_num>100 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.73
+    },
+    "Q15": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_s2c_byte_num<200 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.65
+    },
+    "Q16": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_schema_type='DNS' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.37
+    },
+    "Q17": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_establish_latency_ms>200 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.38
+    },
+    "Q18": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_con_duration_ms>10000 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.4
+    },
+    "Q19": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.43394
+    },
+    "Q20": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_tcp_client_isn=2857077935 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.37579
+    },
+    "Q21": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_tcp_server_isn=0 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.53
+    },
+    "Q22": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.96211
+    },
+    "Q23": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND mail_account='[email protected]' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.36206
+    },
+    "Q24": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND mail_subject='test' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.43868
+    },
+    "Q25": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND dns_qname='qbwup.imtt.qq.com' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.36743000000000003
+    },
+    "Q26": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.43854000000000004
+    },
+    "Q27": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_con_latency_ms>100 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.18
+    },
+    "Q28": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_ja3_hash='a0e9f5d64349fb13191bc781f81f42e1' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.56598
+    },
+    "Q29": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' and common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.9835900000000001
+    },
+    "Q30": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='111.10.53.14' and common_server_port=443 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.39396
+    },
+    "Q31": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND mail_account like 'abc@%' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.43647
+    },
+    "Q32": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.7076699999999999
+    },
+    "Q33": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.38982
+    },
+    "Q34": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.46476999999999996
+    },
+    "Q35": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_port not in (80,443) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.74
+    },
+    "Q36": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.31
+    },
+    "Q37": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.36
+    },
+    "Q38": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.09526000000000001
+    },
+    "Q39": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.20244
+    },
+    "Q40": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_internal_ip='223.116.37.192' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.22019
+    },
+    "Q41": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.20865
+    },
+    "Q42": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_external_ip='111.10.53.14' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.22103
+    },
+    "Q43": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_port=52607 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.12726
+    },
+    "Q44": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_port=443 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.41708
+    },
+    "Q45": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_c2s_pkt_num>5 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.7536900000000001
+    },
+    "Q46": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_s2c_pkt_num>5 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.45353
+    },
+    "Q47": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_c2s_byte_num>100 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 1.65
+    },
+    "Q48": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_s2c_byte_num<200 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 2.15
+    },
+    "Q49": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_schema_type='DNS' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.44014
+    },
+    "Q50": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_establish_latency_ms>200 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.38824000000000003
+    },
+    "Q51": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_con_duration_ms>10000 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 2.64
+    },
+    "Q52": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.14549
+    },
+    "Q53": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_tcp_client_isn=2857077935 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.11427
+    },
+    "Q54": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_tcp_server_isn=0 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 2.47
+    },
+    "Q55": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.17830000000000001
+    },
+    "Q56": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND mail_account='[email protected]' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.12283
+    },
+    "Q57": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND mail_subject='test' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.11985
+    },
+    "Q58": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND dns_qname='qbwup.imtt.qq.com' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.12695
+    },
+    "Q59": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.13737
+    },
+    "Q60": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_con_latency_ms>100 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.29123000000000004
+    },
+    "Q61": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_ja3_hash='a0e9f5d64349fb13191bc781f81f42e1' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.14195
+    },
+    "Q62": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' and common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.18922
+    },
+    "Q63": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='111.10.53.14' and common_server_port=443 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.21106999999999998
+    },
+    "Q64": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND mail_account like 'abc@%' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.12737
+    },
+    "Q65": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.13991
+    },
+    "Q66": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.12999000000000002
+    },
+    "Q67": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.19359
+    },
+    "Q68": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_port not in (80,443) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 2.05
+    },
+    "Q69": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.30738
+    },
+    "Q70": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 2.7
+    },
+    "Q71": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE from_unixtime(common_recv_time,'UTC+8') IN ( SELECT from_unixtime(common_recv_time,'UTC+8') FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30 ) AND common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 55.26
+    },
+    "Q72": {
+        "sql": "SELECT  *  FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30 ) AND common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 56.57
+    },
+    "Q73": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE from_unixtime(common_recv_time,'UTC+8') IN ( SELECT from_unixtime(common_recv_time,'UTC+8') FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30 ) AND common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 3.22
+    },
+    "Q74": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( select common_log_id FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00')) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 3.11
+    },
+    "Q75": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.25814
+    },
+    "Q76": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.31645999999999996
+    },
+    "Q77": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.33541000000000004
+    },
+    "Q78": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.23615
+    },
+    "Q79": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.24516
+    },
+    "Q80": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.31065
+    },
+    "Q81": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.19763999999999998
+    },
+    "Q82": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.21516
+    },
+    "Q83": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.22791999999999998
+    },
+    "Q84": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.17809999999999998
+    },
+    "Q85": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.26827999999999996
+    },
+    "Q86": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.42894
+    },
+    "Q87": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 3.25
+    },
+    "Q88": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.25841000000000003
+    },
+    "Q89": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.27802
+    },
+    "Q90": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.34414999999999996
+    },
+    "Q91": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.21599000000000002
+    },
+    "Q92": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.2801
+    },
+    "Q93": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.2764
+    },
+    "Q94": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.1895
+    },
+    "Q95": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.22807
+    },
+    "Q96": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.20404
+    },
+    "Q97": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.1992
+    },
+    "Q98": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.26435000000000003
+    },
+    "Q99": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.38391000000000003
+    },
+    "Q100": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 3.15
+    },
+    "Q101": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.19171000000000002
+    },
+    "Q102": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.29261000000000004
+    },
+    "Q103": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.2921
+    },
+    "Q104": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.19996
+    },
+    "Q105": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.20894
+    },
+    "Q106": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.24040999999999998
+    },
+    "Q107": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.19461
+    },
+    "Q108": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.17981999999999998
+    },
+    "Q109": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.22385
+    },
+    "Q110": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.17955000000000002
+    },
+    "Q111": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.27309
+    },
+    "Q112": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.39267
+    },
+    "Q113": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 3.22
+    },
+    "Q114": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.25616
+    },
+    "Q115": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.34006000000000003
+    },
+    "Q116": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.30954000000000004
+    },
+    "Q117": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.20414
+    },
+    "Q118": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.2275
+    },
+    "Q119": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.26546
+    },
+    "Q120": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.1933
+    },
+    "Q121": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.17586000000000002
+    },
+    "Q122": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.22254
+    },
+    "Q123": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.18174
+    },
+    "Q124": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.27979000000000004
+    },
+    "Q125": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 0.39874
+    },
+    "Q126": {
+        "sql": "SELECT from_unixtime(common_recv_time,'UTC+8') , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( Select common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time DESC LIMIT 30",
+        "used_time": 3.23
+    },
+    "Q127": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.36068
+    },
+    "Q128": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.46001
+    },
+    "Q129": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 1.35
+    },
+    "Q130": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.45011
+    },
+    "Q131": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.45512
+    },
+    "Q132": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 1.16
+    },
+    "Q133": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.45904
+    },
+    "Q134": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.46691000000000005
+    },
+    "Q135": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.75117
+    },
+    "Q136": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.46162000000000003
+    },
+    "Q137": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.49191
+    },
+    "Q138": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 2.57
+    },
+    "Q139": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_client_ip AS connection_record_log_common_client_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time DESC LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 54.94
+    },
+    "Q140": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.35425
+    },
+    "Q141": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.48378
+    },
+    "Q142": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 1.39
+    },
+    "Q143": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.47247
+    },
+    "Q144": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.48531
+    },
+    "Q145": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 1.13
+    },
+    "Q146": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.49589
+    },
+    "Q147": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.45419
+    },
+    "Q148": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.75599
+    },
+    "Q149": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.4738
+    },
+    "Q150": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.4658
+    },
+    "Q151": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 2.58
+    },
+    "Q152": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_server_ip AS connection_record_log_common_server_ip WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 54.65
+    },
+    "Q153": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.37915
+    },
+    "Q154": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.50649
+    },
+    "Q155": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 1.38
+    },
+    "Q156": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.46901
+    },
+    "Q157": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.48901
+    },
+    "Q158": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 1.16
+    },
+    "Q159": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.43785
+    },
+    "Q160": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.43218
+    },
+    "Q161": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.78038
+    },
+    "Q162": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.46172
+    },
+    "Q163": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.48931
+    },
+    "Q164": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 2.4
+    },
+    "Q165": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_http_domain AS connection_record_log_http_domain WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 55.25
+    },
+    "Q166": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_log_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.35807
+    },
+    "Q167": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip='36.189.226.21' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.50897
+    },
+    "Q168": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_server_ip='8.8.8.8' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 1.35
+    },
+    "Q169": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_sled_ip='%192.168%' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.48512
+    },
+    "Q170": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_stream_trace_id=1153021139190754263 ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.4929
+    },
+    "Q171": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain='microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 1.18
+    },
+    "Q172": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni='note.youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.38994999999999996
+    },
+    "Q173": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_subscriber_id='%test%' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.41275
+    },
+    "Q174": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain like '%baidu.com%' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.74711
+    },
+    "Q175": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND ssl_sni like '%youdao.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.40082
+    },
+    "Q176": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_client_ip in ('36.189.226.21','111.10.53.14') ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 0.4747
+    },
+    "Q177": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 2.45
+    },
+    "Q178": {
+        "sql": "SELECT * FROM connection_record_log AS connection_record_log WHERE common_log_id IN ( SELECT common_log_id FROM connection_record_log_common_subscriber_id AS connection_record_log_common_subscriber_id WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain not like '%microsoft.com' ) ORDER BY common_recv_time desc LIMIT 30",
+        "used_time": 55.36
+    },
+    "Q179": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", count(common_log_id) AS \"logs\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.26406
+    },
+    "Q180": {
+        "sql": "SELECT from_unixtime(cast(common_recv_time/30 as int) * 30,'UTC+8') AS stat_time, sum(common_c2s_byte_num) AS bytes_sent, sum(common_s2c_byte_num) AS bytes_received, sum(common_c2s_byte_num + common_s2c_byte_num) AS bytes, sum(common_c2s_pkt_num + common_s2c_pkt_num) AS packets, sum(common_sessions) AS sessions FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') GROUP BY from_unixtime(cast(common_recv_time/30 as int) * 30,'UTC+8') ORDER BY stat_time ASC LIMIT 10000",
+        "used_time": 1.57
+    },
+    "Q181": {
+        "sql": "SELECT from_unixtime(cast(common_recv_time/300 as int) * 300,'UTC+8') AS stat_time, common_schema_type AS type, sum(common_sessions) AS sessions, sum(common_c2s_byte_num + common_s2c_byte_num) AS bytes, sum(common_c2s_pkt_num + common_s2c_pkt_num) AS packets FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') GROUP BY from_unixtime(cast(common_recv_time/300 as int) * 300,'UTC+8'), common_schema_type ORDER BY stat_time ASC LIMIT 10000",
+        "used_time": 1.68
+    },
+    "Q182": {
+        "sql": "SELECT round(sum(common_s2c_byte_num) * 8 / 300,2) AS trafficInBits, round(sum(common_c2s_byte_num) * 8 / 300,2) AS trafficOutBits, round(sum(common_s2c_byte_num + common_c2s_byte_num) * 8 / 300,2) AS trafficTotalBits, round(sum(common_s2c_pkt_num) / 300,2) AS trafficInPackets, round(sum(common_c2s_pkt_num) / 300,2) AS trafficOutPackets, round(sum(common_s2c_pkt_num + common_c2s_pkt_num) / 300,2) AS trafficTotalPackets, round(sum(common_sessions) / 300,2) AS sessions FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00')",
+        "used_time": 0.22853
+    },
+    "Q183": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", approx_distinct(common_internal_ip) AS \"Unique Internal IP\", approx_distinct(common_external_ip) AS \"Unique External IP\", approx_distinct(common_subscriber_id) AS \"Unique Subscriber ID\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 2.33
+    },
+    "Q184": {
+        "sql": "SELECT 'all' AS type, approx_distinct(common_client_ip) AS client_ips, approx_distinct(common_internal_ip) AS internal_ips, approx_distinct(common_server_ip) AS server_ips, approx_distinct(common_external_ip) AS external_ips, approx_distinct(common_subscriber_id) as subscriber_ids FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') UNION ALL SELECT 'tcp' AS type, approx_distinct(common_client_ip) AS client_ips, approx_distinct(common_internal_ip) AS internal_ips, approx_distinct(common_server_ip) AS server_ips, approx_distinct(common_external_ip) AS external_ips, approx_distinct(common_subscriber_id) as subscriber_ids FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_l4_protocol IN ( 'IPv4_TCP', 'IPv6_TCP' ) UNION ALL SELECT 'UDP' AS type, approx_distinct(common_client_ip) AS client_ips, approx_distinct(common_internal_ip) AS internal_ips, approx_distinct(common_server_ip) AS server_ips, approx_distinct(common_external_ip) AS external_ips, approx_distinct(common_subscriber_id) as subscriber_ids FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND common_l4_protocol IN ( 'IPv4_UDP', 'IPv6_UDP' )",
+        "used_time": 3.4
+    },
+    "Q185": {
+        "sql": "SELECT from_unixtime(cast(common_recv_time/300 as int) * 300,'UTC+8') AS stat_time, (CASE WHEN common_stream_dir = 1 THEN 'c2s' WHEN common_stream_dir = 2 THEN 's2c' WHEN common_stream_dir = 3 THEN 'double' ELSE 'None' END) AS type, sum(common_sessions) AS sessions FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') GROUP BY from_unixtime(cast(common_recv_time/300 as int) * 300,'UTC+8'), common_stream_dir ORDER BY stat_time ASC LIMIT 10000",
+        "used_time": 0.92944
+    },
+    "Q186": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(common_sessions) AS \"Sessions\", sum(if(common_stream_dir <> 3, common_sessions, 0)) AS \"one_side_sessions\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", round(one_side_sessions / sessions, 2) AS one_side_percent FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": -1,
+        "info": "State Failed: line 1:257: Column 'one_side_sessions' cannot be resolved"
+    },
+    "Q187": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(common_c2s_byte_num + common_s2c_byte_num) AS \"Bytes\", sum(common_c2s_tcp_lostlen + common_s2c_tcp_lostlen) AS \"gap_loss_bytes\", round(gap_loss_bytes / bytes, 2) AS gap_loss_percent FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( common_l4_protocol IN ( 'IPv4_TCP', 'IPv6_TCP' ) ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": -1,
+        "info": "State Failed: line 1:206: Column 'gap_loss_bytes' cannot be resolved"
+    },
+    "Q188": {
+        "sql": "SELECT \"server_ip\" AS \"server_ip\" , SUM(coalesce(\"Bytes\",0)) AS \"Bytes\" , SUM(coalesce(\"bytes_sent\",0)) AS \"Sent\" , SUM(coalesce(\"bytes_received\",0)) AS \"Received\" , SUM(coalesce(\"Sessions\",0)) AS \"Sessions\" FROM ( SELECT SUM(coalesce(common_c2s_byte_num,0)) AS \"bytes_sent\" , SUM(coalesce(common_s2c_byte_num,0)) AS \"bytes_received\" , SUM(common_c2s_byte_num+common_s2c_byte_num) AS \"Bytes\" , SUM(coalesce(common_sessions,0)) AS \"Sessions\" , common_server_ip AS \"server_ip\" FROM connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(common_server_ip)!= 0 ) GROUP BY common_server_ip ORDER BY \"Bytes\" desc ) GROUP BY \"server_ip\" ORDER BY \"Bytes\" desc LIMIT 30",
+        "used_time": 0.28597
+    },
+    "Q189": {
+        "sql": "SELECT common_client_ip , COUNT(*) AS sessions FROM connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') GROUP BY common_client_ip ORDER BY sessions desc LIMIT 30",
+        "used_time": 0.18028
+    },
+    "Q190": {
+        "sql": "SELECT \"Server Port\" AS \"Server Port\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT common_server_port AS \"Server Port\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( common_l4_protocol IN ( 'IPv4_TCP', 'IPv6_TCP' ) ) GROUP BY common_server_port LIMIT 1048576) GROUP BY \"Server Port\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.21816
+    },
+    "Q191": {
+        "sql": "SELECT \"domain\" AS \"Website Domain\" , SUM(coalesce(\"Bytes\",0)) AS \"Throughput\" FROM ( SELECT SUM(coalesce(common_c2s_byte_num,0)) AS \"bytes_sent\" , SUM(coalesce(common_s2c_byte_num,0)) AS \"bytes_received\" , SUM(coalesce(common_c2s_byte_num+common_s2c_byte_num,0)) AS \"Bytes\" , http_domain AS \"domain\" FROM connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain ORDER BY \"Bytes\" desc ) GROUP BY \"domain\" ORDER BY \"Throughput\" desc LIMIT 30",
+        "used_time": 0.18771000000000002
+    },
+    "Q192": {
+        "sql": "SELECT \"device_id\" AS \"device_id\", sum(coalesce(\"Bytes\", 0)) AS \"Bytes\", sum(coalesce(\"bytes_sent\", 0)) AS \"Sent\", sum(coalesce(\"bytes_received\", 0)) AS \"Received\" FROM (SELECT sum(coalesce(common_c2s_byte_num, 0)) AS \"bytes_sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"bytes_received\", sum(common_c2s_byte_num + common_s2c_byte_num) AS Bytes, common_device_id AS \"device_id\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY common_device_id ORDER BY \"Bytes\" DESC LIMIT 1048576) GROUP BY \"device_id\" ORDER BY \"Bytes\" DESC LIMIT 30",
+        "used_time": 0.20686000000000002
+    },
+    "Q193": {
+        "sql": "SELECT \"Http.Domain\" AS \"Http.Domain\", sum(coalesce(\"Client IP\", 0)) AS \"Client IP\" FROM (SELECT http_domain AS \"Http.Domain\", approx_distinct(common_client_ip) AS \"Client IP\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain ORDER BY \"Client IP\" DESC LIMIT 1048576) GROUP BY \"Http.Domain\" ORDER BY \"Client IP\" DESC LIMIT 30",
+        "used_time": 0.32426
+    },
+    "Q194": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", avg(coalesce(\"Avg Establish Latency(ms)\", 0)) AS \"Avg Establish Latency(ms)\" FROM (SELECT http_domain AS \"Domain\", avg(coalesce(common_establish_latency_ms, 0)) AS \"Avg Establish Latency(ms)\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Avg Establish Latency(ms)\" DESC LIMIT 100",
+        "used_time": 0.18961
+    },
+    "Q195": {
+        "sql": "SELECT \"source\" AS \"source\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT coalesce(nullif(common_subscriber_id, ''), nullif(common_client_ip, '')) AS \"source\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY coalesce(nullif(common_subscriber_id, ''), nullif(common_client_ip, '')) ORDER BY \"Sessions\" DESC LIMIT 1048576) GROUP BY \"source\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.28475
+    },
+    "Q196": {
+        "sql": "SELECT \"destination\" AS \"destination\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT coalesce(nullif(http_domain, ''), nullif(common_server_ip, '')) AS \"destination\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY coalesce(nullif(http_domain, ''), nullif(common_server_ip, '')) ORDER BY \"Sessions\" DESC LIMIT 1048576) GROUP BY \"destination\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.27279000000000003
+    },
+    "Q197": {
+        "sql": "SELECT \"server_location\" AS \"server_location\", sum(coalesce(\"Bytes\", 0)) AS \"Bytes\", sum(coalesce(\"bytes_sent\", 0)) AS \"Sent\", sum(coalesce(\"bytes_received\", 0)) AS \"Received\" FROM (SELECT arrayElement(splitByString(',', common_server_location), length(splitByString(',', common_server_location))) AS \"server_location\", sum(coalesce(common_c2s_byte_num, 0)) AS \"bytes_sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"bytes_received\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY \"server_location\" ORDER BY \"Bytes\" DESC LIMIT 1048576) GROUP BY \"server_location\" ORDER BY \"Bytes\" DESC LIMIT 30",
+        "used_time": -1,
+        "info": "State Failed: line 1:203: Function splitbystring not registered"
+    },
+    "Q198": {
+        "sql": "SELECT \"Http URL\" AS \"Http URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"Http URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY http_url LIMIT 1048576) GROUP BY \"Http URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.16047
+    },
+    "Q199": {
+        "sql": "SELECT \"server_ip\" AS \"server_ip\", groupUniqArray(coalesce(\"trans_app\", 0)) AS \"trans_app\", sum(coalesce(\"Bytes\", 0)) AS \"Bytes\", sum(coalesce(\"bytes_sent\", 0)) AS \"Sent\", sum(coalesce(\"bytes_received\", 0)) AS \"Received\" FROM (SELECT sum(coalesce(common_c2s_byte_num, 0)) AS \"bytes_sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"bytes_received\", sum(common_c2s_byte_num + common_s2c_byte_num) AS \"Bytes\", groupUniqArray(concat(common_l4_protocol, '/', toString(common_server_port))) AS \"trans_app\", common_server_ip AS \"server_ip\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(common_server_ip)!= 0 ) GROUP BY \"server_ip\" ORDER BY \"Bytes\" DESC LIMIT 1048576) GROUP BY \"server_ip\" ORDER BY \"Bytes\" DESC LIMIT 30",
+        "used_time": -1,
+        "info": "State Failed: line 1:455: Function tostring not registered"
+    },
+    "Q200": {
+        "sql": "SELECT \"Subscriber ID\" AS \"Subscriber ID\", \"Http.Domain\" AS \"Http.Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Http.Domain\", common_subscriber_id AS \"Subscriber ID\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(http_domain)!= 0 AND length(common_subscriber_id)!= 0 ) GROUP BY http_domain, common_subscriber_id ORDER BY \"Sessions\" DESC LIMIT 1048576) GROUP BY \"Subscriber ID\", \"Http.Domain\" ORDER BY \"Sessions\" DESC LIMIT 10000",
+        "used_time": 0.16269
+    },
+    "Q201": {
+        "sql": "SELECT \"Http.Domain\" AS \"Http.Domain\" , \"Server IP\" AS \"Server IP\" , SUM(coalesce(\"Bytes Sent\",0)) AS \"Bytes Sent\" FROM ( SELECT common_server_ip AS \"Server IP\" , http_domain AS \"Http.Domain\" , SUM(coalesce(common_c2s_byte_num+common_s2c_byte_num,0)) AS \"Bytes\" , SUM(coalesce(common_c2s_byte_num,0)) AS \"Bytes Sent\" , SUM(coalesce(common_s2c_byte_num,0)) AS \"Bytes Received\" FROM connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(http_domain)!= 0 ) GROUP BY common_server_ip , http_domain ORDER BY \"Bytes\" desc LIMIT 1048576 ) GROUP BY \"Http.Domain\" , \"Server IP\" ORDER BY \"Bytes Sent\" desc LIMIT 10000",
+        "used_time": 0.25604000000000005
+    },
+    "Q202": {
+        "sql": "SELECT \"Http.Domain\" AS \"Http.Domain\", \"Client IP\" AS \"Client IP\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT common_client_ip AS \"Client IP\", http_domain AS \"Http.Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(http_domain)!= 0 ) GROUP BY common_client_ip, http_domain ORDER BY \"Sessions\" DESC LIMIT 1048576) GROUP BY \"Http.Domain\", \"Client IP\" ORDER BY \"Sessions\" DESC LIMIT 10000",
+        "used_time": 0.23937999999999998
+    },
+    "Q203": {
+        "sql": "SELECT from_unixtime(cast(common_recv_time/300 as int) * 300,'UTC+8') AS _time , http_domain AS Domain, COUNT(DISTINCT(common_client_ip)) AS nums FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 AND http_domain IN ( SELECT http_domain FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 GROUP BY http_domain ORDER BY SUM(common_s2c_byte_num+common_c2s_byte_num) DESC LIMIT 5 ) GROUP BY from_unixtime(cast(common_recv_time/300 as int) * 300,'UTC+8') , http_domain ORDER BY from_unixtime(cast(common_recv_time/300 as int) * 300,'UTC+8') DESC LIMIT 10000",
+        "used_time": 0.34332
+    },
+    "Q204": {
+        "sql": "SELECT from_unixtime(cast(common_recv_time/3600 as int) * 3600,'UTC+8') AS stat_time , http_domain , approx_distinct(common_client_ip) AS nums FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00')-604800 AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND http_domain IN ( SELECT http_domain FROM connection_record_log AS connection_record_log WHERE common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') AND length(http_domain)!= 0 GROUP BY http_domain ORDER BY COUNT(*) desc LIMIT 5 ) group by from_unixtime(cast(common_recv_time/3600 as int) * 3600,'UTC+8'), http_domain ORDER BY stat_time desc LIMIT 10000",
+        "used_time": 0.31811
+    },
+    "Q205": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", common_device_id AS \"Device ID\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY cast(common_recv_time/300 as int) * 300,common_device_id LIMIT 10000",
+        "used_time": 0.19402
+    },
+    "Q206": {
+        "sql": "SELECT \"Internal IP\" AS \"Internal IP\", \"Sled IP\" AS \"Sled IP\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT common_sled_ip AS \"Sled IP\", common_internal_ip AS \"Internal IP\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY common_sled_ip, common_internal_ip LIMIT 1048576) GROUP BY \"Internal IP\", \"Sled IP\" ORDER BY \"Sessions\" DESC LIMIT 10000",
+        "used_time": 0.27267
+    },
+    "Q207": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_log_id=1153021139190754263 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.11251
+    },
+    "Q208": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip='36.189.226.21' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.20513
+    },
+    "Q209": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_internal_ip='223.116.37.192' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.18125
+    },
+    "Q210": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_ip='8.8.8.8' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.231
+    },
+    "Q211": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_external_ip='111.10.53.14' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.19637000000000002
+    },
+    "Q212": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_port=52607 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.15869
+    },
+    "Q213": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_port=443 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.22385
+    },
+    "Q214": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_c2s_pkt_num>5 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.20392
+    },
+    "Q215": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_s2c_pkt_num>5 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.21084
+    },
+    "Q216": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_c2s_byte_num>100 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.22788999999999998
+    },
+    "Q217": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_s2c_byte_num<200 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.23088999999999998
+    },
+    "Q218": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_schema_type='DNS' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.22823
+    },
+    "Q219": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_establish_latency_ms>200 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.20681
+    },
+    "Q220": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_con_duration_ms>10000 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.24586000000000002
+    },
+    "Q221": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_stream_trace_id=1153021139190754263 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.14101
+    },
+    "Q222": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_tcp_client_isn=2857077935 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.14925
+    },
+    "Q223": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_tcp_server_isn=0 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.25838
+    },
+    "Q224": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain='microsoft.com' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.18921000000000002
+    },
+    "Q225": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_account='[email protected]' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.14707
+    },
+    "Q226": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_subject='test' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.13628
+    },
+    "Q227": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND dns_qname='qbwup.imtt.qq.com' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.1371
+    },
+    "Q228": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_sni='note.youdao.com' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.13369999999999999
+    },
+    "Q229": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_con_latency_ms>100 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.19569999999999999
+    },
+    "Q230": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_ja3_hash='a0e9f5d64349fb13191bc781f81f42e1' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.16922
+    },
+    "Q231": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip='36.189.226.21' and common_server_ip='8.8.8.8' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.23146
+    },
+    "Q232": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_ip='111.10.53.14' and common_server_port=443 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.22249000000000002
+    },
+    "Q233": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_account like 'abc@%' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.15214
+    },
+    "Q234": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain like '%baidu.com%' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.15527000000000002
+    },
+    "Q235": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_sni like '%youdao.com' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.13525
+    },
+    "Q236": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip in ('36.189.226.21','111.10.53.14') ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.21915
+    },
+    "Q237": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_port not in (80,443) ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.27605
+    },
+    "Q238": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND length(http_domain)!= 0 ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.20987999999999998
+    },
+    "Q239": {
+        "sql": "SELECT cast(common_recv_time/300 as int) * 300 AS \"Receive Time\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes\", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS \"Packets\", sum(coalesce(common_sessions, 0)) AS \"New Sessions\", sum(coalesce(common_c2s_byte_num, 0)) AS \"Bytes Sent\", sum(coalesce(common_s2c_byte_num, 0)) AS \"Bytes Received\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\", sum(coalesce(common_s2c_pkt_num, 0)) AS \"Packets Received\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain not like '%microsoft.com' ) GROUP BY cast(common_recv_time/300 as int) * 300 LIMIT 10000",
+        "used_time": 0.25066
+    },
+    "Q240": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_log_id=1153021139190754263 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.12294
+    },
+    "Q241": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip='36.189.226.21' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.19090000000000001
+    },
+    "Q242": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_internal_ip='223.116.37.192' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.18803999999999998
+    },
+    "Q243": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_ip='8.8.8.8' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.18181
+    },
+    "Q244": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_external_ip='111.10.53.14' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.18450999999999998
+    },
+    "Q245": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_port=52607 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.14664
+    },
+    "Q246": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_port=443 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.18250999999999998
+    },
+    "Q247": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_c2s_pkt_num>5 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17697
+    },
+    "Q248": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_s2c_pkt_num>5 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17959
+    },
+    "Q249": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_c2s_byte_num>100 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.18586000000000003
+    },
+    "Q250": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_s2c_byte_num<200 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17545
+    },
+    "Q251": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_schema_type='DNS' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.16963
+    },
+    "Q252": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_establish_latency_ms>200 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.20604
+    },
+    "Q253": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_con_duration_ms>10000 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.18666
+    },
+    "Q254": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_stream_trace_id=1153021139190754263 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.13873
+    },
+    "Q255": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_tcp_client_isn=2857077935 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.1415
+    },
+    "Q256": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_tcp_server_isn=0 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17329
+    },
+    "Q257": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain='microsoft.com' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.16479
+    },
+    "Q258": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_account='[email protected]' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.15536000000000003
+    },
+    "Q259": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_subject='test' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.14683000000000002
+    },
+    "Q260": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND dns_qname='qbwup.imtt.qq.com' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17744
+    },
+    "Q261": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_sni='note.youdao.com' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17172
+    },
+    "Q262": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_con_latency_ms>100 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.18046
+    },
+    "Q263": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_ja3_hash='a0e9f5d64349fb13191bc781f81f42e1' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.18888999999999997
+    },
+    "Q264": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip='36.189.226.21' and common_server_ip='8.8.8.8' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.21543
+    },
+    "Q265": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_ip='111.10.53.14' and common_server_port=443 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.21233000000000002
+    },
+    "Q266": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_account like 'abc@%' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17218
+    },
+    "Q267": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain like '%baidu.com%' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.15352000000000002
+    },
+    "Q268": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_sni like '%youdao.com' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17839
+    },
+    "Q269": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip in ('36.189.226.21','111.10.53.14') ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.19256
+    },
+    "Q270": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_port not in (80,443) ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17643999999999999
+    },
+    "Q271": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND length(http_domain)!= 0 ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.1601
+    },
+    "Q272": {
+        "sql": "SELECT \"Domain\" AS \"Domain\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_domain AS \"Domain\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain not like '%microsoft.com' ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Domain\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.16535
+    },
+    "Q273": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_log_id=1153021139190754263 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.11935
+    },
+    "Q274": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip='36.189.226.21' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.178
+    },
+    "Q275": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_internal_ip='223.116.37.192' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.21406999999999998
+    },
+    "Q276": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_ip='8.8.8.8' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.15094
+    },
+    "Q277": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_external_ip='111.10.53.14' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17652
+    },
+    "Q278": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_port=52607 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.14592
+    },
+    "Q279": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_port=443 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.173
+    },
+    "Q280": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_c2s_pkt_num>5 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17706
+    },
+    "Q281": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_s2c_pkt_num>5 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.16516999999999998
+    },
+    "Q282": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_c2s_byte_num>100 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17735
+    },
+    "Q283": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_s2c_byte_num<200 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17396999999999999
+    },
+    "Q284": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_schema_type='DNS' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.16879
+    },
+    "Q285": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_establish_latency_ms>200 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17419
+    },
+    "Q286": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_con_duration_ms>10000 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17778
+    },
+    "Q287": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_stream_trace_id=1153021139190754263 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.15115
+    },
+    "Q288": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_tcp_client_isn=2857077935 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.1351
+    },
+    "Q289": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_tcp_server_isn=0 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.166
+    },
+    "Q290": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain='microsoft.com' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.16513
+    },
+    "Q291": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_account='[email protected]' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.14577
+    },
+    "Q292": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_subject='test' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.13585
+    },
+    "Q293": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND dns_qname='qbwup.imtt.qq.com' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.16490000000000002
+    },
+    "Q294": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_sni='note.youdao.com' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.14649
+    },
+    "Q295": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_con_latency_ms>100 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.16341999999999998
+    },
+    "Q296": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_ja3_hash='a0e9f5d64349fb13191bc781f81f42e1' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.1674
+    },
+    "Q297": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip='36.189.226.21' and common_server_ip='8.8.8.8' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.20374
+    },
+    "Q298": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_ip='111.10.53.14' and common_server_port=443 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.19063
+    },
+    "Q299": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND mail_account like 'abc@%' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.15414
+    },
+    "Q300": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain like '%baidu.com%' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.15148
+    },
+    "Q301": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND ssl_sni like '%youdao.com' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.13233
+    },
+    "Q302": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_client_ip in ('36.189.226.21','111.10.53.14') ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17523
+    },
+    "Q303": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND common_server_port not in (80,443) ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.18084999999999998
+    },
+    "Q304": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND length(http_domain)!= 0 ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.17256
+    },
+    "Q305": {
+        "sql": "SELECT \"URL\" AS \"URL\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT http_url AS \"URL\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) AND http_domain not like '%microsoft.com' ) AND ( length(http_url)!= 0 ) GROUP BY http_url LIMIT 1048576) GROUP BY \"URL\" ORDER BY \"Sessions\" DESC LIMIT 30",
+        "used_time": 0.19968
+    },
+    "Q306": {
+        "sql": "SELECT \"Http.Domain\" AS \"Http.Domain\", sum(coalesce(\"Unique Client IP\", 0)) AS \"Unique Client IP\", sum(coalesce(\"Unique Subscriber ID\", 0)) AS \"Unique Subscriber ID\" FROM (SELECT http_domain AS \"Http.Domain\", approx_distinct(common_client_ip) AS \"Unique Client IP\", approx_distinct(common_subscriber_id) AS \"Unique Subscriber ID\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( length(http_domain)!= 0 ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Http.Domain\" ORDER BY \"Unique Client IP\" DESC LIMIT 100",
+        "used_time": 0.3347
+    },
+    "Q307": {
+        "sql": "SELECT \"Http.Domain\" AS \"Http.Domain\", sum(coalesce(\"Packets Sent\", 0)) AS \"Packets Sent\" FROM (SELECT http_domain AS \"Http.Domain\", sum(coalesce(common_c2s_pkt_num, 0)) AS \"Packets Sent\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY http_domain LIMIT 1048576) GROUP BY \"Http.Domain\" ORDER BY \"Packets Sent\" DESC LIMIT 100",
+        "used_time": 0.16021000000000002
+    },
+    "Q308": {
+        "sql": "SELECT \"Internal IP\" AS \"Internal IP\", \"External IP\" AS \"External IP\", \"Sled IP\" AS \"Sled IP\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT common_sled_ip AS \"Sled IP\", common_external_ip AS \"External IP\", common_internal_ip AS \"Internal IP\", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS \"Bytes Sent+Bytes Received\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( common_stream_dir != 3 ) GROUP BY common_sled_ip, common_external_ip ,common_internal_ip LIMIT 1048576) GROUP BY \"Internal IP\", \"External IP\", \"Sled IP\" ORDER BY \"Sessions\" DESC LIMIT 500",
+        "used_time": 0.33824
+    },
+    "Q309": {
+        "sql": "SELECT \"Client ASN\" AS \"Client ASN\", \"Server ASN\" AS \"Server ASN\", sum(coalesce(\"Sessions\", 0)) AS \"Sessions\" FROM (SELECT common_server_asn AS \"Server ASN\", common_client_asn AS \"Client ASN\", sum(coalesce(common_sessions, 0)) AS \"Sessions\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) AND ( common_stream_dir != 3 ) GROUP BY common_server_asn, common_client_asn LIMIT 1048576) GROUP BY \"Client ASN\", \"Server ASN\" ORDER BY \"Sessions\" DESC LIMIT 500",
+        "used_time": 0.25132
+    },
+    "Q310": {
+        "sql": "SELECT \"SSL.SNI\" AS \"SSL.SNI\", \"Client IP\" AS \"Client IP\", avg(coalesce(\"Establish Latency(ms)\", 0)) AS \"Establish Latency(ms)\" FROM (SELECT common_client_ip AS \"Client IP\", ssl_sni AS \"SSL.SNI\", avg(coalesce(common_establish_latency_ms, 0)) AS \"Establish Latency(ms)\" FROM connection_record_log AS connection_record_log WHERE ( ( common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') ) ) GROUP BY common_client_ip, ssl_sni LIMIT 1048576) GROUP BY \"SSL.SNI\", \"Client IP\" ORDER BY \"Establish Latency(ms)\" DESC LIMIT 500",
+        "used_time": 0.25248
+    },
+    "Q311": {
+        "sql": "select  FROM_UNIXTIME(min(common_recv_time)) as \"First Seen\" , FROM_UNIXTIME(max(common_recv_time)) as \"Last Seen\" ,  median(http_response_lantency_ms) as \"Server Processing Time Median(ms)\", count(1) as Responses,any(common_server_location)  as Location from connection_record_log WHERE  common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00')  AND  http_domain='baidu.com'",
+        "used_time": -1,
+        "info": "State Failed: line 1:119: Function median not registered"
+    },
+    "Q312": {
+        "sql": "select common_client_ip as \"Client IP\" , avg(common_establish_latency_ms) as \"Establishing Time Mean(ms)\", count(1) as Responses,any(common_client_location) as Location from connection_record_log where  common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00')  and http_domain='baidu.com' group by \"Client IP\" order by Responses desc limit 100",
+        "used_time": -1,
+        "info": "State Failed: line 1:130: Function any not registered"
+    },
+    "Q313": {
+        "sql": "select common_server_ip as \"Server IP\" , avg(http_response_lantency_ms) as \"Server Processing Time Mean(ms)\", count(1) as Responses,any(common_server_location) as Location from connection_record_log where common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') and http_domain='baidu.com' group by \"Server IP\" order by Responses desc limit 100",
+        "used_time": -1,
+        "info": "State Failed: line 1:133: Function any not registered"
+    },
+    "Q314": {
+        "sql": "select http_url as \"URI\" , avg(http_response_lantency_ms) as \"Server Processing Time Mean(ms)\", count(1) as Responses from connection_record_log where  common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') and http_domain='baidu.com' group by http_url order by Responses desc limit 100",
+        "used_time": 0.12628
+    },
+    "Q315": {
+        "sql": "select  common_l7_protocol as \"Protocol\" , approx_distinct(common_client_ip) as \"Clients\" , approx_distinct(common_server_ip) as \"Servers\", count(1) as Sessions,sum(common_c2s_byte_num+common_s2c_byte_num)  as bytes from connection_record_log where common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') and length(common_l7_protocol)!= 0  group by common_l7_protocol  order by bytes desc",
+        "used_time": 1.44
+    },
+    "Q316": {
+        "sql": "select common_client_ip as \"Client IP\" , count(1) as Sessions,sum(common_c2s_byte_num) as \"Bytes Out\", sum(common_s2c_byte_num) as \"Bytes In\",any(common_client_location) as Location from connection_record_log where common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') and common_l7_protocol='SIP' group by \"Client IP\" order by Sessions desc limit 100",
+        "used_time": -1,
+        "info": "State Failed: line 1:143: Function any not registered"
+    },
+    "Q317": {
+        "sql": "select common_server_ip as \"Server IP\" , count(1) as Sessions,sum(common_c2s_byte_num) as \"Bytes Out\", sum(common_s2c_byte_num) as \"Bytes In\",any(common_server_location) as Location from connection_record_log where common_recv_time >= to_unixtime(timestamp '2021-05-30 12:00:00') AND common_recv_time < to_unixtime(timestamp '2021-06-30 12:00:00') and common_l7_protocol='SIP' group by \"Server IP\" order by Sessions desc limit 100",
+        "used_time": -1,
+        "info": "State Failed: line 1:143: Function any not registered"
+    }
+}
\ No newline at end of file
diff --git a/run.sh b/run.sh
index 7168353..d693018 100644
--- a/run.sh
+++ b/run.sh
@@ -1,7 +1,9 @@
 for i in {1,2,3}
 do
-python ./src/autotest.py ch
-echo 1 > /proc/sys/vm/drop_caches
-python ./src/autotest.py ol
-echo 1 > /proc/sys/vm/drop_caches
+    echo "running ClickHouse test"
+    python ./src/run.py ch
+    echo 1 > /proc/sys/vm/drop_caches
+    echo "running OpenLookeng test"
+    python ./src/run.py ol
+    echo 1 > /proc/sys/vm/drop_caches
 done
\ No newline at end of file
diff --git a/src/config b/src/config
index 0af947c..94983ec 100644
--- a/src/config
+++ b/src/config
@@ -1,20 +1,34 @@
 
-[clickhouse]
+[clickhouse-local]
 host = 192.168.40.223
 port = 9001
 user = default
 password = 111111
 
-
-[openlookeng]
-host = 192.168.40.223
+[openlookeng-local]
+host = 192.168.40.152
 port = 18080
 user = olk
 catalog = clickhouse223
 schema = tsg_galaxy_v3
 
 
+[clickhouse]
+host = 10.111.200.170
+port = 9001
+user = default
+password = ceiec2019
+
+
+[openlookeng]
+host = 	10.111.201.1
+port = 8090
+user = olk
+catalog = clickhouselt
+schema = tsg_galaxy_v3
+
+
 [run]
 time1 = 2021-05-30 12:00:00
 time2 = 2021-06-30 12:00:00
-time_out = 1200
\ No newline at end of file
+time_out = 1200
diff --git a/temp.py b/src/convert_sql.py
index 2c0131a..e730642 100644
--- a/temp.py
+++ b/src/convert_sql.py
@@ -1,7 +1,10 @@
-import json
 
+
+## convert clickhouse's sql into openlookeng's sql
+
+import json
 def txt_to_json():
-    with open("./src/poc-ch.txt",'r') as file:
+    with open("poc-ch.txt",'r') as file:
         content = file.readlines()
         i = 1
         all = {}
@@ -70,14 +73,14 @@ def change_sql(origin_sql):
     return changed_sql
 
 def ch_to_ol():
-    with open("./src/poc-ch.json","r") as file:
+    with open("./poc-ch.json","r") as file:
         content = file.read()
         all = json.loads(content)
     olsql = {}
     for k,v in all.items():
         olsql[k] = change_sql(v)
 
-    with open("./src/auto-ol.json","w") as file:
+    with open("./auto-ol.json","w") as file:
         file.write(json.dumps(olsql))
 
 ch_to_ol()
\ No newline at end of file
diff --git a/src/openlookeng_driver.py b/src/openlookeng_driver.py
index 6645493..1564cb6 100644
--- a/src/openlookeng_driver.py
+++ b/src/openlookeng_driver.py
@@ -97,7 +97,7 @@ class WebResult:
 
     # 尝试获取结果
     def __get_result_immediately(self):
-        # 返回当前执行的状态
+        # 返回当前执行的状态 
         result = self.client.get_query(self.uuid)
         if result is not None:
             #print(result)
@@ -112,6 +112,7 @@ class WebResult:
                 self.error_info = result['error']['message']
                 self.write_log('error',"SQL : "+self.sql)
                 self.write_log('error',result['error']['message'])
+                raise Exception("State Failed: {}".format(self.error_info))
             else:
                 return None
         return result
@@ -122,6 +123,8 @@ class WebResult:
             return self.result
         if timeout is None:
             timeout = 5
+        else:
+            timeout = int(timeout)
         use_time = 0
         interval = 0.5
         while True:
@@ -134,13 +137,12 @@ class WebResult:
             use_time += interval
             time.sleep(interval)
             interval = math.ceil(use_time/10)
-        return None
+        raise Exception("Timeout {} > {}".format(use_time,timeout))
 
     def get_used_time(self,timeout = None):
         self.get_result(timeout)
         if self.used_time is None:
             return 0
-        #print(self.used_time)
         if "ms" in self.used_time:
             return float(re.sub("ms","",self.used_time))/1000
         elif "s" in self.used_time:
@@ -175,12 +177,13 @@ class WebResult:
         if csv_path is not None:
             if csv_name is None:
                 csv_name = csv_path.split('/')[-1]
-                print("csv_name:",csv_name)
             response = requests.get(csv_path)
             if response.status_code == 200:
                 content = response.content
                 with open(csv_name,'w') as file:
                     file.write(content)
+        else:
+            raise Exception("Download Error")
                         
 def print_csv(csv_path):
     response = requests.get(csv_path)
@@ -194,10 +197,9 @@ def print_csv(csv_path):
                 print_seperator = False
                 length = len(line)
                 print("-"*length)
-        
     else:
-        print("Error -->",response.status_code)
-
+        raise Exception("error: status code: {}".format(response.status_code))
+    
 class Client:
     def __init__(self,host="127.0.0.1",port=8080,user="lk",catalog="system",schema="runtime",timeout = 10000):
         self.host = host
@@ -298,7 +300,7 @@ class Client:
         return None
 
 if __name__ == "__main__":
-    client = Client(host='192.168.40.152',port=18080,user='lk',catalog='clickhouse152',schema='ssb')
+    client = Client(host='192.168.40.152',port=18080,user='lk',catalog='clickhouse223',schema='tsg_galaxy_v3')
     client.add_logging(log_level=logging.DEBUG)
 
     #result = client.web_execute("SELECT sum(LO_REVENUE),  year(LO_ORDERDATE) AS year,  P_BRAND  FROM lineorder_flat  WHERE P_CATEGORY = 'MFGR#12' AND S_REGION = 'AMERICA'  GROUP BY  year(LO_ORDERDATE),  P_BRAND  ORDER BY  year(LO_ORDERDATE),  P_BRAND LIMIT 3")
diff --git a/src/autotest.py b/src/run.py
index edd32c1..733b884 100644
--- a/src/autotest.py
+++ b/src/run.py
@@ -46,7 +46,7 @@ def run_ch(test_sql,now_time = '2021'):
             result['data_num'] = -1
             result['info'] = str(e)
             fail_num += 1
-            print("running Q{} success , {}√，{}×".format(k,suc_num,fail_num))
+            print("running Q{} failed , {}√，{}×".format(k,suc_num,fail_num))
 
         results[k] = result
         try:
@@ -55,8 +55,9 @@ def run_ch(test_sql,now_time = '2021'):
         except Exception as e:
             print("error",e)
         try:
-            with open("../log/ch-result.log","a+") as file:
-                file.write("{} success num: {}  failed num: {} \n".format(now_time,suc_num,fail_num))
+            file = open("../log/ch-result.log","a+")
+            file.write("{} success num: {}  failed num: {} \n".format(now_time,suc_num,fail_num))
+            file.close()
         except Exception as e:
             print(e)
         time.sleep(10)
@@ -65,7 +66,7 @@ def run_ch(test_sql,now_time = '2021'):
 
 def run_olk(test_sql,now_time = '2021'):
     client = openlookeng_driver.Client(host=olconfig['host'],port=int(olconfig['port']),user=olconfig['user'],catalog=olconfig['catalog'],schema=olconfig['schema'])
-    client.add_logging(log_level=logging.DEBUG)
+    #client.add_logging(log_level=logging.DEBUG)
     results = {}
     total_time = 0
     suc_num,fail_num = 0,0
@@ -73,23 +74,26 @@ def run_olk(test_sql,now_time = '2021'):
         result = {}
         run_sql = change_sql(v)
         result['sql'] = run_sql
-        web_result = client.web_execute(run_sql)
-        used_time = float(web_result.get_used_time(sql_timeout))  # second
-        total_time += used_time
-        result['used_time'] = used_time
-        result['data_num'] = 0
-        result['info'] = web_result.error_info
-        if web_result.error_info == '':
+        try:
+            web_result = client.web_execute(run_sql)
+            used_time = float(web_result.get_used_time(sql_timeout))  # second
+            web_result.download_csv("../log/"+str(k)+".csv")
+            total_time += used_time
+            result['used_time'] = used_time
+            result['data_num'] = 0
             suc_num += 1
             print("running Q{} success , {}√，{}×".format(k,suc_num,fail_num))
-
-        else:
+        except Exception as e:
+            result['used_time'] = -1
+            result['data_num'] = 0
+            result['info'] = str(e)
             fail_num += 1
-            print("running Q{} success , {}√，{}×".format(k,suc_num,fail_num))
+            print("running Q{} failed , {}√，{}×".format(k,suc_num,fail_num))
         results[k] = result
         try:
-            with open("../log/ol-" + now_time + ".json",'w') as file:
-                file.write(json.dumps(results))
+            file = open("../log/ol-" + now_time + ".json",'w')
+            file.write(json.dumps(results))
+            file.close()
         except Exception as e:
             print("error",e)
         try: