dnsfilter_get_qps
Retrieve queries-per-second time series to monitor live DNS traffic pulse, with optional filters for time period, traffic source, and allowed/blocked/all report types.
Instructions
Queries-per-second time series - the closest thing to a live traffic pulse.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Report UTC upper bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (end of day, inclusive). Defaults to now. | |
| from | No | Report UTC lower bound. Accepts YYYY-MM-DDThh:mm:ss[Z], YYYY-MM-DDThh:mm[Z], or a bare YYYY-MM-DD date (start of day). Defaults to 1 day ago. | |
| type | No | Report type. Defaults to all. | |
| msp_id | No | MSP ID to scope the report to. | |
| source | No | Comma-separated traffic source. Defaults to all. | |
| nat_ips | No | Comma-separated NAT IP addresses to filter to. | |
| user_ids | No | Comma-separated local user IDs. Defaults to all. | |
| agent_ids | No | Comma-separated user-agent (client) UUIDs. Defaults to all. | |
| private_ip | No | Filter to a specific private/internal IP address. | |
| agent_types | No | Comma-separated agent/client types. | |
| bucket_size | No | Time-bucket size: 'auto' (default), '15min', or '1day'. Auto picks 15min for a <24h range and 1day for a >=24h range. | |
| network_ids | No | Comma-separated network (site) IDs. Defaults to all. | |
| mac_addresses | No | Comma-separated MAC addresses to filter to. | |
| private_ip_to | No | Upper bound of a private/internal IP address range. | |
| collection_ids | No | Comma-separated collection (roaming-client group) IDs. | |
| application_ids | No | Comma-separated application IDs to filter to. | |
| private_ip_from | No | Lower bound of a private/internal IP address range. | |
| security_report | No | Threat-only report. 'all' returns both threats and non-threats. | |
| organization_ids | No | Comma-separated organization IDs. Defaults to the user organization ID. An inaccessible/unknown ID returns a 403. | |
| show_individual_networks | No | Group results by individual network ID. Defaults to false. |