NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

Grouping is meaningful only for attributes whose values can recur across records. Attributes that produce unique values per event, as well as aggregate result fields such as COUNT(Matched Events), cannot serve as grouping attributes because they do not provide a valid common value on which to form event groups.