I have some data in InfluxDB that is connected events for certain TCP connections. So the measurement is connection_events with tags being: mac_address of connecting system, and some other metadata. The value is just connected=true|false
What I want to do is something like this:
select count(mac_address), mac_address
from connection_events
where count(mac_address) > X
group by mac_address
In other words, I want to see results like:
28,ABCD
14,EFGH
3,XYZQ
However, InfluxDB doesn't like this kind of query. I can't figure out how to parse through the dataset of connection events and aggregate them by mac address.