diff --git a/Clickhouse最新全量建表语句/性能测试脚本/ck_query.sh b/Clickhouse最新全量建表语句/性能测试脚本/ck_query.sh
new file mode 100644
index 0000000..f6c3c11
--- /dev/null
+++ b/Clickhouse最新全量建表语句/性能测试脚本/ck_query.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+sql_file=$1 # sql文件路径
+operation=$2 # 1是批量查询，2是单条依次查询
+startTime="'2024-01-28 15:11:32'"
+endTime="'2024-01-29 15:11:32'"
+query_batch=1 # 批量查询同时查询的数量
+host=192.168.44.12
+port=9001
+user=default
+password=galaxy2019
+query_count=$(wc -l < "$sql_file")
+
+if [ $operation -eq 1 ];then
+  start_time=$(date +%s.%N)
+  cat $sql_file | sed "s/start_time/$startTime/g" | sed "s/end_time/$endTime/g" | awk -F ';' '{print $2}' | clickhouse-benchmark -h $host -p $port --user=$user --password=$password -i $query_count -d 0 -c $query_batch
+  end_time=$(date +%s.%N)
+  total_time=$(echo $(printf "%.3f" "$(echo "scale=3; $end_time - $start_time" | bc)"))
+  echo "Elapsed Time: $total_time seconds"
+  echo "Avg Elapsed Time: $(echo $(printf "%.3f" "$(echo "scale=3; $total_time / $query_count" | bc)")) seconds"
+  exit 0
+else
+  total_time=0
+  set -f
+  while IFS= read -r line
+  do
+    query=$(echo $line | sed "s/start_time/$startTime/g" | sed "s/end_time/$endTime/g")
+    query_name=$(echo $query | awk -F ';' '{print $1}')
+    sql=$(echo $query | awk -F ';' '{print $2}')
+    query_time=$(clickhouse-client --host=$host --port=$port --user=$user --password=$password -t --query="$sql" 2>&1  >/dev/null)
+    echo "Query: $query_name"
+    echo "Elapsed Time: $query_time seconds"
+    total_time=$(echo "$total_time + $query_time" | bc)
+  done < $sql_file
+  echo "Total Elapsed Time: $total_time seconds"
+  echo "Avg Elapsed Time: $(echo $(printf "%.3f" "$(echo "scale=3; $total_time / $query_count" | bc)")) seconds"
+  exit 0
+fi
diff --git a/Clickhouse最新全量建表语句/性能测试脚本/test.sql b/Clickhouse最新全量建表语句/性能测试脚本/test.sql
new file mode 100644
index 0000000..c17deff
--- /dev/null
+++ b/Clickhouse最新全量建表语句/性能测试脚本/test.sql
@@ -0,0 +1,64 @@
+Q01.All Fields sub Query (default) ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND recv_time < toUnixTimestamp(end_time) LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND recv_time < toUnixTimestamp(end_time) LIMIT 30;
+Q02.All Fields sub Query order by Time desc ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) ORDER BY recv_time DESC LIMIT 30 ;
+Q03.All Fields sub Query order by Time asc ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) ORDER BY recv_time ASC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) ORDER BY recv_time ASC LIMIT 30 ;
+Q04.All Fields sub Query by Filter(log_id=1153021139190754263) ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND log_id = 1153021139190754263 ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND log_id = 1153021139190754263 ORDER BY recv_time DESC LIMIT 30 ;
+Q05.All Fields sub Query by Filter(client_port=52607) ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND client_port = 52607 ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND client_port = 52607 ORDER BY recv_time DESC LIMIT 30 ;
+Q06.All Fields sub Query by Filter(server_port=443) ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND server_port = 443 ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND server_port = 443 ORDER BY recv_time DESC LIMIT 30 ;
+Q07.All Fields sub Query by Filter(sent_pkts>5) ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND sent_pkts > 5 ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND sent_pkts > 5 ORDER BY recv_time DESC LIMIT 30 ;
+Q08.All Fields sub Query by Filter(received_pkts>5) ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND received_pkts > 5 ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND received_pkts > 5 ORDER BY recv_time DESC LIMIT 30 ;
+Q09.All Fields sub Query by Filter(sent_bytes>100) ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND sent_bytes > 100 ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND sent_bytes > 100 ORDER BY recv_time DESC LIMIT 30 ;
+Q10.All Fields sub Query by Filter(received_bytes<200) ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND received_bytes < 200 ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND received_bytes < 200 ORDER BY recv_time DESC LIMIT 30 ;
+Q11.All Fields sub Query by Filter(decoded_as='DNS');SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND decoded_as = 'DNS' ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND decoded_as = 'DNS' ORDER BY recv_time DESC LIMIT 30 ;
+Q12.All Fields sub Query by Filter(tcp_handshake_latency_ms>200) ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND tcp_handshake_latency_ms > 200 ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND tcp_handshake_latency_ms > 200 ORDER BY recv_time DESC LIMIT 30 ;
+Q13.All Fields sub Query by Filter(duration_ms>10000);SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND duration_ms > 10000 ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND duration_ms > 10000 ORDER BY recv_time DESC LIMIT 30 ;
+Q14.All Fields sub Query by Filter(session_id=1153021139190754263);SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND session_id = 1153021139190754263 ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND session_id = 1153021139190754263 ORDER BY recv_time DESC LIMIT 30 ;
+Q15.All Fields sub Query by Filter(tcp_client_isn=2857077935);SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND tcp_client_isn = 2857077935 ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND tcp_client_isn = 2857077935 ORDER BY recv_time DESC LIMIT 30 ;
+Q16.All Fields sub Query by Filter(tcp_server_isn=0);SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND tcp_server_isn = 0 ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND tcp_server_isn = 0 ORDER BY recv_time DESC LIMIT 30 ;
+Q17.All Fields sub Query by Filter(mail_account='abc@xx.com');SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND mail_account = 'abc@xx.com' ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND mail_account = 'abc@xx.com' ORDER BY recv_time DESC LIMIT 30 ;
+Q18.All Fields sub Query by Filter(mail_subject='test') ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND mail_subject = 'test' ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND mail_subject = 'test' ORDER BY recv_time DESC LIMIT 30 ;
+Q19.All Fields sub Query by Filter(dns_qname='qbwup.imtt.qq.com');SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND dns_qname = 'qbwup.imtt.qq.com' ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND dns_qname = 'qbwup.imtt.qq.com' ORDER BY recv_time DESC LIMIT 30 ;
+Q20.All Fields sub Query by Filter(ssl_sni='note.youdao.com');SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND ssl_sni = 'note.youdao.com' ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND ssl_sni = 'note.youdao.com' ORDER BY recv_time DESC LIMIT 30 ;
+Q21.All Fields sub Query by Filter(ssl_handshake_latency_ms>100) ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND ssl_handshake_latency_ms > 100 ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND ssl_handshake_latency_ms > 100 ORDER BY recv_time DESC LIMIT 30 ;
+Q22.All Fields sub Query by Filter(ssl_ja3_hash='a0e9f5d64349fb13191bc781f81f42e1') ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND ssl_ja3_hash = 'a0e9f5d64349fb13191bc781f81f42e1' ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND ssl_ja3_hash = 'a0e9f5d64349fb13191bc781f81f42e1' ORDER BY recv_time DESC LIMIT 30 ;
+Q23.All Fields sub Query by Filter(server_ip='111.10.53.14' and server_port=443) ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND server_ip = '111.10.53.14' AND server_port = 443 ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND server_ip = '111.10.53.14' AND server_port = 443 ORDER BY recv_time DESC LIMIT 30 ;
+Q24.All Fields sub Query by Filter(mail_account like 'abc@%');SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND mail_account LIKE 'abc@%' ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND mail_account LIKE 'abc@%' ORDER BY recv_time DESC LIMIT 30 ;
+Q25.All Fields sub Query by Filter(ssl_sni like '%youdao.com');SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND ssl_sni LIKE '%youdao.com' ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND ssl_sni LIKE '%youdao.com' ORDER BY recv_time DESC LIMIT 30 ;
+Q26.All Fields sub Query by Filter(server_port not in (80,443))   ;SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time IN (SELECT recv_time FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND server_port NOT IN (80, 443) ORDER BY recv_time DESC LIMIT 30) AND recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND server_port NOT IN (80, 443) ORDER BY recv_time DESC LIMIT 30 ;
+Q27.ip_protocol top10 ;select ip_protocol ,count() from tsg_galaxy_v3.session_record where recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by ip_protocol order by count() desc limit 10 ;
+Q28.decoded_as top10 ;select decoded_as ,count() from tsg_galaxy_v3.session_record where recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by decoded_as order by count() desc limit 10 ;
+Q29.client_ip top10 ;select client_ip ,count() from tsg_galaxy_v3.session_record where recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by client_ip order by count() desc limit 10 ;
+Q30.client_port top10 ;select client_port ,count() from tsg_galaxy_v3.session_record where recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by client_port order by count() desc limit 10 ;
+Q31.subscriber_id top10 ;select subscriber_id ,count() from tsg_galaxy_v3.session_record where recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by subscriber_id order by count() desc limit 10 ;
+Q32.server_ip top10 ;select server_ip ,count() from tsg_galaxy_v3.session_record where recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by server_ip order by count() desc limit 10 ;
+Q33.server_port top10 ;select server_port ,count() from tsg_galaxy_v3.session_record where recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by server_port order by count() desc limit 10 ;
+Q34.app top10 ;select app ,count() from tsg_galaxy_v3.session_record where recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by app order by count() desc limit 10 ;
+Q35.sent_pkts top10 ;select sent_pkts ,count() from tsg_galaxy_v3.session_record where recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by sent_pkts order by count() desc limit 10 ;
+Q36.received_pkts top10 ;select received_pkts ,count() from tsg_galaxy_v3.session_record where recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by received_pkts order by count() desc limit 10 ;
+Q37.http_url top10 ;select http_url ,count() from tsg_galaxy_v3.session_record where recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by http_url order by count() desc limit 10 ;
+Q38.http_host top10 ;select http_host ,count() from tsg_galaxy_v3.session_record where recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by http_host order by count() desc limit 10 ;
+Q39.server_domain top10 ;select server_domain ,count() from tsg_galaxy_v3.session_record where recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by server_domain order by count() desc limit 10 ;
+Q40.ip_protocol top10 by Filter(client_ip='36.189.226.21'); select ip_protocol ,count() from tsg_galaxy_v3.session_record where client_ip='36.189.226.21' and recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by ip_protocol order by count() desc limit 10 ;
+Q41.client_ip top10 by Filter(server_ip='8.8.8.8');select client_ip ,count() from tsg_galaxy_v3.session_record where server_ip='8.8.8.8' and recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by client_ip order by count() desc limit 10 ;
+Q42.client_port top10 by Filter(server_port=443);select client_port ,count() from tsg_galaxy_v3.session_record where server_port=443 and recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by client_port order by count() desc limit 10 ;
+Q43.subscriber_id top10 by Filter(sent_bytes > 100);select subscriber_id ,count() from tsg_galaxy_v3.session_record where sent_bytes > 100 and recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by subscriber_id order by count() desc limit 10 ;
+Q44.server_port top10 by Filter(received_bytes<200);select server_port ,count() from tsg_galaxy_v3.session_record where received_bytes<200 and recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by server_port order by count() desc limit 10 ;
+Q45.app top10 by Filter(server_domain like '%baidu.com%');select app ,count() from tsg_galaxy_v3.session_record where server_domain like '%baidu.com%' and recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) and server_domain like '%baidu.com%' group by app order by count() desc limit 10 ;
+Q46.sent_pkts top10 by Filter(ssl_sni='note.youdao.com');select sent_pkts ,count() from tsg_galaxy_v3.session_record where ssl_sni='note.youdao.com' and recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by sent_pkts order by count() desc limit 10 ;
+Q47.received_pkts top10 by Filter(server_ip='111.10.53.14' and server_port=443);select received_pkts ,count() from tsg_galaxy_v3.session_record where server_ip='111.10.53.14' and server_port=443 and recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by received_pkts order by count() desc limit 10 ;
+Q48.http_url top10 by Filter(sent_bytes>100);select http_url ,count() from tsg_galaxy_v3.session_record where sent_bytes>100 and recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by http_url order by count() desc limit 10 ;
+Q49.http_host top10 by Filter(server_ip='8.8.8.8');select http_host ,count() from tsg_galaxy_v3.session_record where server_ip='8.8.8.8' and recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by http_host order by count() desc limit 10 ;
+Q50.server_domain top10 by Filter(decoded_as='HTTP');select server_domain ,count() from tsg_galaxy_v3.session_record where decoded_as='HTTP' and recv_time >= toUnixTimestamp(start_time) and  recv_time < toUnixTimestamp(end_time) group by server_domain order by count() desc limit 10 ;
+Q51.Bandwidth Trend (Time Grain 60 second)  nofilter ;SELECT toDateTime(toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(toUnixTimestamp(recv_time)), INTERVAL 60 SECOND))))) AS stat_time, decoded_as AS type, sum(sent_bytes + received_bytes) AS bytes, sum(sent_pkts + received_pkts) AS packets FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) GROUP BY toDateTime(toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(toUnixTimestamp(recv_time)), INTERVAL 60 SECOND))))), decoded_as LIMIT 100000 ;
+Q52.Bandwidth Trend (Time Grain 60 second)  by Filter(client_ip='36.189.226.21') ;SELECT toDateTime(toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(toUnixTimestamp(recv_time)), INTERVAL 60 SECOND))))) AS stat_time, decoded_as AS type, sum(sent_bytes + received_bytes) AS bytes, sum(sent_pkts + received_pkts) AS packets FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND client_ip='36.189.226.21' GROUP BY toDateTime(toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(toUnixTimestamp(recv_time)), INTERVAL 60 SECOND))))), decoded_as LIMIT 100000 ;
+Q53.Bandwidth Trend (Time Grain 60 second)  by Filter(server_ip='8.8.8.8') ;SELECT toDateTime(toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(toUnixTimestamp(recv_time)), INTERVAL 60 SECOND))))) AS stat_time, decoded_as AS type, sum(sent_bytes + received_bytes) AS bytes, sum(sent_pkts + received_pkts) AS packets FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND server_ip='8.8.8.8' GROUP BY toDateTime(toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(toUnixTimestamp(recv_time)), INTERVAL 60 SECOND))))), decoded_as LIMIT 100000 ;
+Q54.Bandwidth Trend (Time Grain 60 second)  by Filter(server_domain='microsoft.com') ;SELECT toDateTime(toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(toUnixTimestamp(recv_time)), INTERVAL 60 SECOND))))) AS stat_time, decoded_as AS type, sum(sent_bytes + received_bytes) AS bytes, sum(sent_pkts + received_pkts) AS packets FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND server_domain='microsoft.com' GROUP BY toDateTime(toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(toUnixTimestamp(recv_time)), INTERVAL 60 SECOND))))), decoded_as LIMIT 100000 ;
+Q55.Bandwidth Trend (Time Grain 60 second) by Filter(server_ip='111.10.53.14' and server_port=443);SELECT toDateTime(toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(toUnixTimestamp(recv_time)), INTERVAL 60 SECOND))))) AS stat_time, decoded_as AS type, sum(sent_bytes + received_bytes) AS bytes, sum(sent_pkts + received_pkts) AS packets FROM tsg_galaxy_v3.session_record AS session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND server_ip='111.10.53.14' and server_port=443 GROUP BY toDateTime(toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(toUnixTimestamp(recv_time)), INTERVAL 60 SECOND))))), decoded_as LIMIT 100000 ;
+Q56.Metrics Query by Filter(decoded_as='HTTP') ;SELECT ROUND(AVG(http_response_latency_ms)) AS http_response_latency FROM tsg_galaxy_v3.session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND decoded_as = 'HTTP' ;
+Q57.Metrics Query by Filter(app = 'qq_r2');SELECT ROUND(SUM(tcp_c2s_rtx_pkts + tcp_s2c_rtx_pkts)/SUM(sent_pkts + received_pkts),4) AS avg_pkt_retrans_percent FROM tsg_galaxy_v3.session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND app = 'qq_r2' ;
+Q58.Metrics Query by Filter(server_domain='qq.com') ;SELECT ROUND(SUM(tcp_c2s_rtx_pkts + tcp_s2c_rtx_pkts)/SUM(sent_pkts + received_pkts),4) AS avg_pkt_retrans_percent FROM tsg_galaxy_v3.session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND server_domain = 'qq.com' ;
+Q59.Metrics Query by Filter(client_ip='116.178.223.59');SELECT ROUND(SUM(tcp_c2s_rtx_pkts + tcp_s2c_rtx_pkts)/SUM(sent_pkts + received_pkts),4) AS avg_pkt_retrans_percent FROM tsg_galaxy_v3.session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND client_ip = '116.178.223.59' ;
+Q60.Metrics Query by Filter(server_ip='8.8.8.8');SELECT ROUND(SUM(tcp_c2s_rtx_pkts + tcp_s2c_rtx_pkts)/SUM(sent_pkts + received_pkts),4) AS avg_pkt_retrans_percent FROM tsg_galaxy_v3.session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND server_ip = '8.8.8.8' ;
+Q61.Metrics Query by Filter(app = 'qq_r2') group by recv_time;SELECT ROUND(SUM(tcp_c2s_rtx_pkts + tcp_s2c_rtx_pkts)/SUM(sent_pkts + received_pkts),4) as max_pkt_retrans_percent FROM tsg_galaxy_v3.session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND app = 'qq_r2' GROUP by recv_time order BY max_pkt_retrans_percent desc limit 1 ;
+Q62.Metrics Query by Filter(server_domain='qq.com') group by recv_time;SELECT ROUND(SUM(tcp_c2s_rtx_pkts + tcp_s2c_rtx_pkts)/SUM(sent_pkts + received_pkts),4) as max_pkt_retrans_percent FROM tsg_galaxy_v3.session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND server_domain = 'qq.com' GROUP by recv_time order BY max_pkt_retrans_percent desc limit 1 ;
+Q63.Metrics Query by Filter(client_ip='116.178.223.59') group by recv_time;SELECT ROUND(SUM(tcp_c2s_rtx_pkts + tcp_s2c_rtx_pkts)/SUM(sent_pkts + received_pkts),4) as max_pkt_retrans_percent FROM tsg_galaxy_v3.session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND client_ip = '116.178.223.59' GROUP by recv_time order BY max_pkt_retrans_percent desc limit 1 ;
+Q64.Metrics Query by Filter(server_ip='8.8.8.8') group by recv_time;SELECT ROUND(SUM(tcp_c2s_rtx_pkts + tcp_s2c_rtx_pkts)/SUM(sent_pkts + received_pkts),4) as max_pkt_retrans_percent FROM tsg_galaxy_v3.session_record WHERE recv_time >= toUnixTimestamp(start_time) AND  recv_time < toUnixTimestamp(end_time) AND server_ip = '8.8.8.8' GROUP by recv_time order BY max_pkt_retrans_percent desc limit 1 ;