////////////////////////////////////////////////////////////////////
v = {
 "timeRangeStart": 2023-06-16T14:44:00Z,
  "timeRangeStop": 2023-06-18T14:44:00Z
}

bucket = "telegraf"

////////////////////////////////////////////////////////////////////
hosts = ${httpHost:json}

hostsLength = hosts |> length()
measurement = "nginx_access-logv3"
from(bucket: "${bucket}")
  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)
  |> filter(fn: (r) => r["_measurement"] == measurement and (r["_field"] == "client_ip" or r["_field"] == "nginx_host"))
  |> pivot(rowKey:["_time"],
        columnKey: ["_field"],
        valueColumn: "_value")
  |> filter(fn: (r) => if hostsLength>0 then contains(value: r["nginx_host"], set: hosts) else true)      
  |> duplicate(column: "client_ip", as: "_value")
  |> group(columns: ["client_ip"])
  |>count()
  |> group()
  |> sort(columns: ["_value"], desc: true)