QuestionQ28Verified/Event SearchCopy linkReport a problemAsk AstroTutorSave questionWhich query can be used to filter users with more than 25 total logons?A#event_simpleName=UserLogon| stats(UserName)| where (totalLogons >25)B#event_simpleName=UserLogon| groupBy(UserName, function=(count(aid, as=totalLogons)))| test(totalLogons > 25)C#event_simpleName=UserLogonI stats(UserName, function=(count(aid, as=totalLogons)))| where(totalLogons > 25)D#event_simpleName=UserLogon| groupBy(UserName)| where(totalLogons >25)Show AnswerAnswerExplanationgroupBy(UserName, function=(count(aid, as=totalLogons))) creates a per-user aggregate count named totalLogons, and test(totalLogons > 25) filters those aggregate results to users whose count exceeds 25. LogScale supports count(as=...) to name aggregate output fields and test() to compare and filter field values.Learn moreFrequent query operations | LogScale DocumentationgroupBy() | LogScale DocumentationShow comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion