QuestionQ91Verified/Detection AnalysisCopy linkReport a problemAsk AstroTutorSave questionWhich query using the groupBy() function will cause a syntax error?A| groupBy(AggregateId, function=selectLast([@timestamp, aid, LocalIP, SeverityName]))B| groupBy(field=[aid, #event_simpleName], function=count())C| groupBy(field=aid, function=count())D| groupBy(Gtimestamp, ComputerName, aid, #event_simpleName, CommandLine)Show AnswerAnswerExplanationgroupBy() supports one positional grouping-field argument. To group by multiple fields, they must be provided as a single array (for example, groupBy([field1, field2])), while later arguments such as function must be named. Supplying several separate positional fields after the first is invalid syntax.Learn moregroupBy() — CrowdStrike LogScale DocumentationFrequent Query Operations — CrowdStrike LogScale DocumentationShow comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion