alot more changes

internal/storage/clickhouse_traces.go

@@ -334,3 +334,49 @@ func (s *ClickHouseStore) IssueTraces(ctx context.Context, issueID string, opts
 	}
 	return page, nil
 }
+
+// IssueSources returns every distinct source IP recorded for an issue. Source
+// addresses may be in the derived occurrence sample, or on any normalized span
+// belonging to one of the issue's traces (for example, an ingress span's
+// net.peer.ip when the failing child span has no client attributes).
+func (s *ClickHouseStore) IssueSources(ctx context.Context, issueID string) ([]IssueSource, error) {
+	rows, err := s.conn.Query(ctx, fmt.Sprintf(`
+		SELECT ip, min(seen_at), max(seen_at), count()
+		FROM (
+			-- Logs and older occurrences keep their source address in the
+			-- derived sample. Keep this path for data that has no trace.
+			SELECT JSONExtractString(sample, 'sourceIp') AS ip, timestamp AS seen_at
+			FROM %s.issue_occurrences
+			WHERE issue_id = ? AND ip != ''
+
+			UNION ALL
+
+			-- A span error's sample describes the failing span, but the public
+			-- peer is commonly recorded on the ingress span in the same trace.
+			-- Include every normalized span peer for the issue's traces.
+			SELECT peer_ip AS ip, timestamp AS seen_at
+			FROM %s.normalized_events
+			WHERE peer_ip != ''
+			  AND trace_id IN (
+				SELECT DISTINCT trace_id
+				FROM %s.issue_occurrences
+				WHERE issue_id = ? AND trace_id != ''
+			  )
+		)
+		WHERE ip != ''
+		GROUP BY ip
+		ORDER BY count() DESC, max(seen_at) DESC`, s.db, s.db, s.db), issueID, issueID)
+	if err != nil {
+		return nil, fmt.Errorf("clickhouse issue sources: %w", err)
+	}
+	defer rows.Close()
+	var out []IssueSource
+	for rows.Next() {
+		var source IssueSource
+		if err := rows.Scan(&source.IP, &source.FirstSeen, &source.LastSeen, &source.Count); err != nil {
+			return nil, err
+		}
+		out = append(out, source)
+	}
+	return out, rows.Err()
+}