{
    "name" : "Top Contacted Servers",
    "i18n_name" : "db_search.top_contacted_servers",
    "data_source" : "flows",
    "show_in_page" : "overview",
    "hourly": false,
    "visualization_type" : "table",
    "select" : {
        "sql": "IPv4NumToString(IPV4_DST_ADDR) IPV4_DST_ADDR_FORMATTED, IPv6NumToString(IPV6_DST_ADDR) IPV6_DST_ADDR_FORMATTED, any(DST_LABEL) DST_LABEL, COUNT(DISTINCT(IPV4_SRC_ADDR)) AS count4, COUNT(DISTINCT(IPV6_SRC_ADDR)) AS count6, (count4 + count6) AS client_count, COUNT(DISTINCT(IP_SRC_PORT)) AS port_count",
        "items" : [
            { 
                "name" : "IPV4_DST_ADDR" 
            },
            {
                "name" : "IPV6_DST_ADDR"
            },
            {
                "name" : "client_count",
                "func" : "",
                "value_type" : "number"
            }, 
            {
                "name" : "port_count",
                "func" : "",
                "value_type" : "number"
            }
        ]
    },
    "groupby" : {
        "items" : [
            {
                "name" : "IPV4_DST_ADDR"
            },
            {
                "name" : "IPV6_DST_ADDR"
            }
        ]
    },
    "sortby" : {
        "items" : [
            {
                "name" : "client_count",
                "order" : "DESC"
            }
        ]
    }
}
