Blocked Queries Over Time

Count of blocked DNS queries bucketed over time.

KQL Library  /  Pi-hole

 Pi-hole blocked-queries-over-time.kql

Count of blocked DNS queries bucketed over time.

 Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com

// Summarize the count of blocked DNS queries over time

PiHole
| where QueryType == "Blocked"  // Filter for blocked queries
| summarize Count = count() by bin(TimeGenerated, 1h)  // Aggregate counts in 1-hour intervals
| render timechart  // Visualize the data as a time chart