Pi-hole

 KQL Library / Pi-hole

Pi-hole

Queries against Pi-hole DNS data ingested into a Log Analytics workspace (as a custom `PiHole` / `pihole_CL` table). Useful for home-lab telemetry, DNS-based hunting practice, and workshop material.

← All KQL categories

• Blocked Queries Over Time blocked-queries-over-time.kql

  Count of blocked DNS queries bucketed over time.

• DNS Query Volume dns-query-volume.kql

  Total DNS query volume over time — the baseline "how loud is DNS" view.

• Most Queried Domains most-queried-domains.kql

  Top 10 most-queried domains.

• New Or Rarely Seen Domains new-or-rarely-seen-domains.kql

  Domains seen in the last 24h that haven't been seen recently — a classic new-domain-observed hunt.

• Pihole Usage pihole-usage.kql

  Billable ingest volume for the Pi-hole custom log over the last 90 days.

• Query Type Distribution query-type-distribution.kql

  Distribution of DNS query types (A, AAAA, TXT, etc.).

• Success Vs Failure success-vs-failure.kql

  Successful vs failed DNS query counts.

• Top Blocked Domains top-blocked-domains.kql

  Top 10 blocked domains.

• Top Clients top-clients.kql

  Top 10 clients by DNS query count.