Im trying to order and display by the highest count for @computed.message field, but encountering the below error:
POST /_sql?format=txt
{
"query":"SELECT \"@timestamp\", \"@computed.message\", \"@computed.blocked\", \"sourceIpAddress\" FROM \"csco-fmc-ms\" where \"@timestamp\" > now() - interval 60 minutes AND \"@computed.message\" IS NOT NULL ORDER BY COUNT(*)"
}
The error is a bit cryptic and could probably be improved, but what it tries to say is that there's nothing to count on as requested in the ORDER BY COUNT(*): you need a grouping (i.e. an aggregation) to be counted, if you want to order by its cardinality. So it's an SQL semantical error.
A potential example: SELECT "@computed.message" FROM ... [WHERE ...] GROUP BY "@computed.message" ORDER BY COUNT(*).
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.