SELECT source_ip, COUNT(*) as count 
FROM connection_logs 
WHERE destination_port = 445 
GROUP BY source_ip 
HAVING count > 100 
ORDER BY count DESC;

destination_port=445 
| groupby(source_ip, function=count() as count) 
| where(count > 100) 
| sort(count, order=desc)

SELECT department, COUNT(*) as user_count 
FROM users 
GROUP BY department;

| groupby(department, function=count() as user_count)

SELECT 
  event_type, 
  COUNT(*) as event_count, 
  AVG(duration) as avg_duration, 
  MAX(duration) as max_duration 
FROM process_events 
GROUP BY event_type;

| groupby(
    event_type, 
    function=[
      count() as event_count, 
      avg(duration) as avg_duration, 
      max(duration) as max_duration
    ]
  )

SELECT 
  DATE_TRUNC('hour', timestamp) as hour, 
  COUNT(*) as event_count 
FROM security_events 
WHERE timestamp >= NOW() - INTERVAL '24 hours' 
GROUP BY DATE_TRUNC('hour', timestamp) 
ORDER BY hour;

timestamp >= -24h
| bucket(_time, "1h", as hour)
| groupby(hour, function=count() as event_count)
| sort(hour)

SELECT user_id, COUNT(*) as login_attempts 
FROM authentication_logs 
WHERE success = false 
GROUP BY user_id 
HAVING COUNT(*) > 5;

success=false 
| groupby(user_id, function=count() as login_attempts) 
| where(login_attempts > 5)