Help Center/ SecMaster/ User Guide/ Log Audit/ Query and Analysis Syntax - V1/ Analysis Statements/ GROUP BY
Updated on 2026-05-15 GMT+08:00
View PDF
Share

GROUP BY

The syntax of a complete analysis statement is as follows:

1
2
3
4
 
SELECT [DISTINCT] (* | expression) [AS alias] [, ...]
[GROUP BY expression [, ...] [HAVING predicates]]
[ORDER BY expression [ASC | DESC] [, ...]]
[LIMIT size OFFSET offset]

Where, GROUP BY indicates grouping by value. The following part describes parameters and examples for the GROUP BY syntax.

Grouping by Field Value

1
 
*|SELECT age GROUP BY age
Table 1 Grouping by field value

age

28

32

36

Grouping by Field Alias

1
 
*|SELECT account_number AS num GROUP BY num
Table 2 Grouping by field alias

num

1

16

13

18

Grouping by Multiple Fields

Example 1: Group data by multiple fields to view the age distribution of account holders.

1
 
*|SELECT account_number AS num, age GROUP BY num, age
Table 3 Grouping by multiple fields

num

age

1

32

16

36

13

28

18

32

Example 2: Group data by multiple fields to view the region distribution of host hcss_ecs_3924.

hostName = 'hcss_ecs_3924'|SELECT hostName AS name, region GROUP BY name, region
Table 4 Examples of grouping by multiple fields

name

region

hcss_ecs_3924

cn-north-7

Using SQL Functions

For details about functions, see Function.

1
 
*|SELECT LENGTH(lastname) AS len, COUNT(*) AS count GROUP BY LENGTH(lastname)
Table 5 Using SQL functions

len

count

4

2

5

2
Parent topic: Analysis Statements