Cloudflare HTTP request analytics by country and status

Returns HTTP request volume for a zone, one row per minute, country, method and response status. This is the replacement for the sunset REST endpoint /zones/{zone_id}/analytics/dashboard: the data now comes from Cloudflare's GraphQL analytics API, exposed here as an ordinary table.

Query

SELECT
datetime,
client_country_name AS country,
client_request_http_method_name AS method,
edge_response_status AS status,
requests,
bytes,
visits
FROM cloudflare.zones.http_requests_adaptive_groups
WHERE zone_tag = '{{zone_tag}}'
AND since = '{{since}}'
AND until = '{{until}}'
ORDER BY requests DESC
LIMIT 100;

Variation: traffic by country only

SELECT
client_country_name AS country,
sum(requests) AS total_requests
FROM cloudflare.zones.http_requests_adaptive_groups
WHERE zone_tag = '{{zone_tag}}'
AND since = '{{since}}'
AND until = '{{until}}'
GROUP BY client_country_name
ORDER BY sum(requests) DESC;

Notes

The parameter is zone_tag here, not zone_id as on the REST-backed zone resources - the analytics surface keeps Cloudflare's GraphQL naming. since and until are both required and must be RFC3339 timestamps; the retention window depends on plan, so a request reaching further back than the plan allows returns no rows rather than an error. The token needs Account -> Analytics -> Read in addition to zone access, and a token without it fails with an authentication error rather than an empty result. Rows are pre-aggregated per minute per dimension combination, so a busy zone over a wide window returns a large result - keep the window tight or aggregate in SQL as the variation does. ORDER BY on an aggregate must repeat the expression rather than reference its alias.