SHOW (SPANS)
    count(*) as Count,
    ClientIpThreatType, ClientIpThreatConfidence 
WHERE (ClientIpThreatConfidence is not omitted)
GROUP BY ClientIpThreatType, ClientIpThreatConfidence 

• Die folgende Abfrage zeigt potenzielle Bedrohungen und ihren maximalen Bedrohungsscore mit der Geomap-Ansicht:

  SHOW (TRACES)
     geoCountryCode, count(*) as "Traces",
     sum(ErrorCount) as "Errors", sum(PageViews) as "Page Views",
     sum(ConnectTime) as "Total connect time",
     max(ClientIpThreatConfidence) as “Threat Confidence”
  WHERE ClientIpThreatType is not omitted and geoCountryCode is not omitted
  GROUP BY geoCountryCode

• Die folgende Abfrage zeigt verdächtige IP-Adressen, ihren geografischen Standort (Stadt und Land), Bedrohungstyp und Bedrohungssicherheit:

  SHOW TRACES case 
   when ClientIpThreatType is omitted 
   then ‘No Threat IP’ 
   else ClientIp end as “IP Address”,
   ClientIpThreatType as “Threat Type”,
   percent_of_items() as “% of activity”, 
   count(*) as Count, 
   max(GeoCountry) as Country,
   max(GeoCity)  as City, 
   max(ClientIpThreatConfidence) as “Threat Confidence” 
  GROUP BY case when ClientIpThreatType is omitted then ‘No Threat IP’ else ClientIp end, ClientIpThreatType
  ORDER BY percent_of_items() desc timeseries for count(*)