Chord Diagram in queries

[scottwilkerson]

The cords are supposed to represent an approximate percentage of traffic that is going to each item. But given the context you outlined, it does appear to seem to be a misgiving because there is only one, and it isn't listing both IP's in the diagram.

If you were to use a different example, it makes more sense
(src ip 172.12.3.77 and dst ip 192.168.1.191) Aggregate By: dstport

Given that, I'm going to try to come up with a suggestion to the development team for a future version. I'm not sure how it will look, but given your first example, it would likely just have a solid circle with 2 IP's across the Cord as 100% of the data would be to/from those 2 IP's