This how-to guide shows you how to apply transformations to your VPC Flow Logs.
In our Data Ingestion How-to Guide for VPC Flow Logs, we showed how to load your data into SQLake, refine it, and prepare it for transformations. Below are a several examples of transformations you can apply to your refined data.
Show how much data was transferred by a specific IP address in a specific time period
SELECTSUM(bytessent) AS uploadTotal,SUM(objectsize) AS downloadTotal,SUM(bytessent + objectsize) AS TotalFROM s3_access_logs_db.mybucket_logsWHERE RemoteIP='1.2.3.4'AND parse_datetime(RequestDateTime,'dd/MMM/yyyy:HH:mm:ss Z')BETWEEN parse_datetime('2017-06-01','yyyy-MM-dd')AND parse_datetime('2017-07-01','yyyy-MM-dd');