# Query the httpBreakdownMetrics Dataset

The **httpBreakdownMetrics** dataset provides real-time, detailed, aggregated data on HTTP request events blocked. This dataset is part of the Real-Time Metrics GraphQL.

This data is retained and available for up to *90* days.

This guide will explain how to query data from the httpBreakdownMetrics dataset using the GraphiQL playground.

---

## Querying data

This example queries the top 20 blocked `remoteAddress` entries. To know more about the available fields, check the [Real-Time Metrics GraphQL API Fields](/en/documentation/devtools/graphql-api/features/gql-real-time-metrics-fields/) documentation.

1. Access the GraphiQL playground in this link: `https://api.azion.com/v4/metrics/graphql`.
    - You must be logged in to your Azion account. Otherwise, you'll receive an error message.
2. Send a query following this format:

```graphql
query {
  httpBreakdownMetrics(
    aggregate: { sum: blockedRequests }
    groupBy: [remoteAddress]
    orderBy: [sum_DESC],
    limit: 20,
    filter: { 
      tsGte: "2024-10-21T11:00:00"
      tsLt: "2024-10-21T12:00:00"
    }
  ) {
    remoteAddress
    totalBlocked: sum
  }
}
```

Where:

| Field | Description |
|----------|----------|
| `sum: blockedRequests` | Returns the total number of requests blocked within the specified time range, after applying any filters |
| `groupBy` | Specifies the fields by which the query results should be grouped. Example: `[remoteAddress]` |
| `orderBy` | Specifies the order in which the results should be returned. Examples: `[sum_DESC]`, for descending order, and `[sum_ASC]`, for ascending order |
| `limit` | Specifies the maximum number of results to return. Example: `20` for retrieving the top 20. System maximum: `10,000` |
| `filter` | Defines the criteria used to filter the data returned by the query |
| `tsGte` | A subfield of `filter`. Specifies the start time (greater than or equal to) for the data query, ensuring results include records from this timestamp onward. Format: "YYYY-MM-DDTHH:mm:ss"; example: `"2024-10-21T11:00:00"` |
| `tsLt` | A subfield of `filter`. Specifies the end time (less than) for the data query, filtering out any records with timestamps equal to or after this timestamp. Format: "YYYY-MM-DDTHH:mm:ss"; example: `"2024-10-21T12:00:00"` |

3. You'll receive a response similar to this:

```graphql
{
  "data": {
    "httpBreakdownMetrics": [
      {
        "remoteAddress": "192.168.0.1",
        "totalBlocked": 6732
      },
      {
        "remoteAddress": "10.0.0.2",
        "totalBlocked": 5872
      },
      {
        "remoteAddress": "172.16.0.3",
        "totalBlocked": 3958
      },
      {
        "remoteAddress": "192.168.1.4",
        "totalBlocked": 3952
      },
      {
        "remoteAddress": "10.0.1.5",
        "totalBlocked": 3806
      },
      {
        "remoteAddress": "172.16.1.6",
        "totalBlocked": 3730
      },
      {
        "remoteAddress": "192.168.2.7",
        "totalBlocked": 3378
      },
      {
        "remoteAddress": "10.0.2.8",
        "totalBlocked": 3318
      },
      {
        "remoteAddress": "172.16.2.9",
        "totalBlocked": 3284
      },
      {
        "remoteAddress": "192.168.3.10",
        "totalBlocked": 3282
      },
      {
        "remoteAddress": "10.0.3.11",
        "totalBlocked": 2958
      },
      {
        "remoteAddress": "172.16.3.12",
        "totalBlocked": 2884
      },
      {
        "remoteAddress": "192.168.4.13",
        "totalBlocked": 2530
      },
      {
        "remoteAddress": "10.0.4.14",
        "totalBlocked": 2348
      },
      {
        "remoteAddress": "172.16.4.15",
        "totalBlocked": 2004
      },
      {
        "remoteAddress": "192.168.5.16",
        "totalBlocked": 1902
      },
      {
        "remoteAddress": "10.0.5.17",
        "totalBlocked": 1538
      },
      {
        "remoteAddress": "172.16.5.18",
        "totalBlocked": 1440
      },
      {
        "remoteAddress": "192.168.6.19",
        "totalBlocked": 1390
      },
      {
        "remoteAddress": "10.0.6.20",
        "totalBlocked": 1314
      }
    ]
  }
}
```

Where:

| Field | Description |
|----------|----------|
| `remoteAddress` | Specifies the IP address of the source making the request. Example: `10.0.6.20` |
| `totalBlocked` | Refers to the total number of times requests from this IP address have been blocked. This field is the result of a sum. Example: `1314` |