DNS Query Volume

Total DNS query volume over time — the baseline 'how loud is DNS' view.

KQL Library  /  Pi-hole

 Pi-hole dns-query-volume.kql

Total DNS query volume over time — the baseline "how loud is DNS" view.

Platforms Pi-hole
Data pihole_CL
Deep Dive  Deep Dive
 Deep Dive  Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Source: Watching The DNS Watcher: Pihole Logs In Sentinel (2025-03-30) — https://www.hanley.cloud/2025-03-30-Watching-the-DNS-Watcher-Pihole-Logs-in-Sentinel/
// Summarize the total number of DNS queries over time
// Platforms: Pi-hole
// Data: pihole_CL

PiHole
| summarize Count = count() by bin(TimeGenerated, 1h)  // Aggregate counts in 1-hour intervals
| render timechart  // Visualize the data as a time chart