netobserv · jpinsonneau · Oct 29, 2025
diff --git a/config/sample-config.yaml b/config/sample-config.yaml
@@ -709,6 +709,15 @@ frontend:
       default: false
       width: 5
       feature: dnsTracking
+    - id: DNSName
+      group: DNS
+      name: DNS Name
+      tooltip: DNS name.
+      field: DnsName
+      filter: dns_name
+      default: false
+      width: 15
+      feature: dnsTracking
     - id: DNSLatency
       group: DNS
       name: DNS Latency
@@ -1168,6 +1177,10 @@ frontend:
       name: DNS Id
       component: number
       hint: Specify a single DNS Id.
+    - id: dns_name
+      name: DNS Name
+      component: text
+      hint: Specify a single DNS name.
     - id: dns_latency
       name: DNS Latency
       component: number
@@ -1522,6 +1535,10 @@ frontend:
     - name: DnsId
       type: number
       description: DNS record id
+    - id: dns_name
+      name: DNS Name
+      component: text
+      hint: Specify a single DNS name.
     - name: DnsLatencyMs
       type: number
       description: Time between a DNS request and response, in milliseconds

diff --git a/pkg/loki/flow_query.go b/pkg/loki/flow_query.go
@@ -207,11 +207,14 @@ func (q *FlowQueryBuilder) appendFilter(sb *strings.Builder, field string) {
 
 func (q *FlowQueryBuilder) appendDNSFilter(sb *strings.Builder) {
 	// ensure at least one Dns field is specified except DnsErrno
-	// |~`"DnsId`|~`"DnsLatencyMs`|~`"DnsFlagsResponseCode"`
+	// |~`"DnsId`|~`"DnsName`|~`"DnsLatencyMs`|~`"DnsFlagsResponseCode"`
 	sb.WriteString("|~`")
 	sb.WriteString(`"DnsId`)
 	sb.WriteString("`")
 	sb.WriteString("|~`")
+	sb.WriteString(`"DnsName`)
+	sb.WriteString("`")
+	sb.WriteString("|~`")
 	sb.WriteString(`"DnsLatencyMs`)
 	sb.WriteString("`")
 	sb.WriteString("|~`")

diff --git a/pkg/model/fields/fields.go b/pkg/model/fields/fields.go
@@ -50,6 +50,7 @@ const (
 	IfDirections           = "IfDirections"
 	NetworkEvents          = "NetworkEvents"
 	DNSID                  = "DnsId"
+	DNSName                = "DnsName"
 	DNSLatency             = "DnsLatencyMs"
 	DNSErrNo               = "DnsErrno"
 	DNSCode                = "DnsFlagsResponseCode"

diff --git a/web/locales/en/plugin__netobserv-plugin.json b/web/locales/en/plugin__netobserv-plugin.json
@@ -572,10 +572,14 @@
   "Overall": "Overall",
   "donut or lines": "donut or lines",
   "The {{function}} {{metric}} with overall over the selected interval": "The {{function}} {{metric}} with overall over the selected interval",
+  "Top {{limit}} DNS name with total": "Top {{limit}} DNS name with total",
+  "Top {{limit}} DNS name": "Top {{limit}} DNS name",
+  "Total DNS name": "Total DNS name",
+  "Total DNS flow count": "Total DNS flow count",
+  "The top DNS name extracted from DNS headers compared to total over the selected interval": "The top DNS name extracted from DNS headers compared to total over the selected interval",
   "Top {{limit}} DNS response code with total": "Top {{limit}} DNS response code with total",
   "Top {{limit}} DNS response code": "Top {{limit}} DNS response code",
   "Total DNS response code": "Total DNS response code",
-  "Total DNS flow count": "Total DNS flow count",
   "The top DNS response code extracted from DNS response headers compared to total over the selected interval": "The top DNS response code extracted from DNS response headers compared to total over the selected interval",
   "rates": "rates",
   "with total": "with total",

diff --git a/web/src/api/ipfix.ts b/web/src/api/ipfix.ts
@@ -81,6 +81,7 @@ export interface Flow {
   PktDropBytes_AB?: number;
   PktDropBytes_BA?: number;
   DnsId?: number;
+  DnsName?: string;
   DnsFlags?: number;
   DnsFlagsResponseCode?: string;
   DnsLatencyMs?: number;

diff --git a/web/src/api/loki.ts b/web/src/api/loki.ts
@@ -137,6 +137,7 @@ export type NetflowMetrics = {
   totalDroppedRateMetric?: TotalRateMetrics;
   droppedStateMetrics?: GenericMetric[];
   droppedCauseMetrics?: GenericMetric[];
+  dnsNameMetrics?: GenericMetric[];
   dnsRCodeMetrics?: GenericMetric[];
   dnsLatencyMetrics?: FunctionMetrics;
   rttMetrics?: FunctionMetrics;

diff --git a/web/src/components/__tests-data__/columns.ts b/web/src/components/__tests-data__/columns.ts
@@ -500,6 +500,17 @@ export const ColumnConfigSampleDefs = [
     default: false,
     width: 5
   },
+  {
+    id: 'DNSName',
+    group: 'DNS',
+    name: 'DNS Name',
+    tooltip: 'DNS name.',
+    field: 'DnsName',
+    filter: 'dns_name',
+    feature: 'dnsTracking',
+    default: false,
+    width: 15
+  },
   {
     id: 'DNSLatency',
     group: 'DNS',
@@ -769,6 +780,11 @@ export const FieldConfigSample = [
     type: 'number',
     description: 'DNS record id'
   },
+  {
+    name: 'DnsName',
+    type: 'text',
+    description: 'DNS name'
+  },
   {
     name: 'DnsLatencyMs',
     type: 'number',

diff --git a/web/src/components/__tests-data__/filters.ts b/web/src/components/__tests-data__/filters.ts
@@ -251,6 +251,12 @@ export const FilterConfigSampleDefs = [
     component: 'number',
     hint: 'Specify a single DNS Id.'
   },
+  {
+    id: 'dns_name',
+    name: 'DNS Name',
+    component: 'text',
+    hint: 'Specify a single DNS Name.'
+  },
   {
     id: 'dns_latency',
     name: 'DNS Latency',

diff --git a/web/src/components/__tests__/netflow-traffic.spec.tsx b/web/src/components/__tests__/netflow-traffic.spec.tsx
@@ -108,7 +108,8 @@ describe('<NetflowTraffic />', () => {
       // 2 queries for packet dropped states & causes
       { ...defaultQuery, function: 'rate', type: 'PktDropPackets', aggregateBy: 'PktDropLatestState' },
       { ...defaultQuery, function: 'rate', type: 'PktDropPackets', aggregateBy: 'PktDropLatestDropCause' },
-      // 2 queries for dns response codes count
+      // 3 queries for dns names, response codes and total
+      { ...defaultQuery, function: 'count', type: 'DnsFlows', aggregateBy: 'DnsName' },
       { ...defaultQuery, function: 'count', type: 'DnsFlows', aggregateBy: 'DnsFlagsResponseCode' },
       { ...defaultQuery, function: 'count', type: 'DnsFlows', aggregateBy: 'app' }
     ];

diff --git a/web/src/components/tabs/netflow-overview/__tests__/netflow-overview.spec.tsx b/web/src/components/tabs/netflow-overview/__tests__/netflow-overview.spec.tsx
@@ -41,8 +41,8 @@ describe('<NetflowOverview />', () => {
     await waitForRender(wrapper);
 
     const containerDiv = wrapper.find(EmptyState);
-    // 12 panels are expected here according to getDefaultOverviewPanels isSelected items
-    expect(containerDiv.length).toEqual(12);
+    // 13 panels are expected here according to getDefaultOverviewPanels isSelected items
+    expect(containerDiv.length).toEqual(13);
   });
 
   it('should render panels', async () => {

diff --git a/web/src/components/tabs/netflow-overview/netflow-overview.tsx b/web/src/components/tabs/netflow-overview/netflow-overview.tsx
@@ -263,6 +263,15 @@ export const NetflowOverview: React.FC<NetflowOverviewProps> = React.forwardRef(
           if (dnsPanels.some(p => p.id.includes('rcode_dns_latency_flows'))) {
             promises.push(
               ...[
+                //get dns names
+                getFlowGenericMetrics(
+                  { ...fq, aggregateBy: 'DnsName', function: 'count', type: 'DnsFlows' },
+                  range
+                ).then(res => {
+                  currentMetrics = { ...currentMetrics, dnsNameMetrics: res.metrics };
+                  setMetrics(currentMetrics);
+                  return res.stats;
+                }),
                 //get dns response codes
                 getFlowGenericMetrics(
                   { ...fq, aggregateBy: 'DnsFlagsResponseCode', function: 'count', type: 'DnsFlows' },
@@ -286,6 +295,7 @@ export const NetflowOverview: React.FC<NetflowOverviewProps> = React.forwardRef(
           setMetrics({
             ...currentMetrics,
             dnsLatencyMetrics: undefined,
+            dnsNameMetrics: undefined,
             dnsRCodeMetrics: undefined,
             totalDnsLatencyMetric: undefined,
             totalDnsCountMetric: undefined
@@ -525,6 +535,10 @@ export const NetflowOverview: React.FC<NetflowOverviewProps> = React.forwardRef(
       return props.metrics.droppedCauseMetrics?.sort((a, b) => getStat(b.stats, 'sum') - getStat(a.stats, 'sum')) || [];
     }, [props.metrics.droppedCauseMetrics]);
 
+    const getTopKDnsNameMetrics = React.useCallback(() => {
+      return props.metrics.dnsNameMetrics?.sort((a, b) => getStat(b.stats, 'sum') - getStat(a.stats, 'sum')) || [];
+    }, [props.metrics.dnsNameMetrics]);
+
     const getTopKDnsRCodeMetrics = React.useCallback(() => {
       return props.metrics.dnsRCodeMetrics?.sort((a, b) => getStat(b.stats, 'sum') - getStat(a.stats, 'sum')) || [];
     }, [props.metrics.dnsRCodeMetrics]);
@@ -924,9 +938,10 @@ export const NetflowOverview: React.FC<NetflowOverviewProps> = React.forwardRef(
               doubleWidth: options.graph!.type !== 'donut'
             };
           }
+          case 'name_dns_latency_flows':
           case 'rcode_dns_latency_flows': {
-            const metricType = 'DnsFlows'; // TODO: consider adding packets graphs here
-            const topKMetrics = getTopKDnsRCodeMetrics();
+            const metricType = id === 'name_dns_latency_flows' ? 'DnsName' : 'DnsFlows'; // TODO: consider adding packets graphs here
+            const topKMetrics = id === 'name_dns_latency_flows' ? getTopKDnsNameMetrics() : getTopKDnsRCodeMetrics();
             const namedTotalMetric = getDnsCountTotalMetric();
             const options = getKebabOptions(id, {
               showNoError: true,
@@ -1060,6 +1075,7 @@ export const NetflowOverview: React.FC<NetflowOverviewProps> = React.forwardRef(
         getNamedTotalMetric,
         getNamedTotalRateMetric,
         getNoInternalTopKRateMetrics,
+        getTopKDnsNameMetrics,
         getTopKDnsRCodeMetrics,
         getTopKDroppedCauseMetrics,
         getTopKDroppedStateMetrics,

diff --git a/web/src/utils/flows.ts b/web/src/utils/flows.ts
@@ -8,6 +8,7 @@ const electMostRelevant = (flowsFor5Tuples: Record[]): Record => {
   return (
     flowsFor5Tuples.find(
       f =>
+        f.fields.DnsName !== undefined ||
         f.fields.DnsId !== undefined ||
         f.fields.PktDropBytes !== undefined ||
         f.fields.PktDropPackets !== undefined ||

diff --git a/web/src/utils/overview-panels.ts b/web/src/utils/overview-panels.ts
@@ -40,6 +40,7 @@ export type OverviewPanelId =
   | `${OverviewPanelRateMetric}`
   | `state_dropped_packet_rates`
   | `cause_dropped_packet_rates`
+  | 'name_dns_latency_flows'
   | 'rcode_dns_latency_flows'
   | `custom_${StatFunction}_${AggregateBy}_${MetricType}`
   | `custom_${AggregateBy}_${MetricType}`
@@ -71,6 +72,7 @@ export const defaultPanelIds: OverviewPanelId[] = [
   'cause_dropped_packet_rates',
   'top_avg_dns_latency',
   'top_p90_dns_latency',
+  'name_dns_latency_flows',
   'rcode_dns_latency_flows',
   'bottom_min_rtt',
   'top_avg_rtt',
@@ -104,7 +106,7 @@ export const getDefaultOverviewPanels = (customIds?: string[]): OverviewPanel[]
         ids = ids.concat(['state_dropped_packet_rates', 'cause_dropped_packet_rates']);
         break;
       case 'dns_latency':
-        ids = ids.concat(['rcode_dns_latency_flows']);
+        ids = ids.concat(['name_dns_latency_flows', 'rcode_dns_latency_flows']);
         break;
     }
 
@@ -303,6 +305,15 @@ export const getOverviewPanelInfo = (
         })
       };
     }
+    case 'name_dns_latency_flows':
+      return {
+        title: t('Top {{limit}} DNS name with total', { limit }),
+        topTitle: t('Top {{limit}} DNS name', { limit }),
+        totalTitle: t('Total DNS name'),
+        chartType: t('donut or bars and lines'),
+        subtitle: t('Total DNS flow count'),
+        tooltip: t('The top DNS name extracted from DNS headers compared to total over the selected interval')
+      };
     case 'rcode_dns_latency_flows':
       return {
         title: t('Top {{limit}} DNS response code with total', { limit }),