FCSS_ADA_AR-6.7 · Question #7
When you perform a Group By on a structured query, which two outcomes occur? (Choose two.)
The correct answer is A. Group By automatically applies a COUNT aggregation. B. Group By is applied to real-time and historical searches. Group By automatically applies a COUNT aggregation. When using Group By in FortiSIEM structured queries, it automatically applies a COUNT(*) function unless a different aggregation (such as SUM, AVG, or MAX) is specified. This helps summarize data by counting occurrences of…
Question
When you perform a Group By on a structured query, which two outcomes occur? (Choose two.)
Options
- AGroup By automatically applies a COUNT aggregation.
- BGroup By is applied to real-time and historical searches.
- CGroup By cannot be applied to an aggregated function.
- DGroup By is applied to historical searches only.
How the community answered
(26 responses)- A88% (23)
- C8% (2)
- D4% (1)
Explanation
Group By automatically applies a COUNT aggregation. When using Group By in FortiSIEM structured queries, it automatically applies a COUNT(*) function unless a different aggregation (such as SUM, AVG, or MAX) is specified. This helps summarize data by counting occurrences of grouped attributes. Group By is applied to real-time and historical searches. Grouping functions work in both real- time (live event monitoring) and historical (past event analysis) searches, making it useful for trend analysis, anomaly detection, and correlation.
Topics
Community Discussion
No community discussion yet for this question.