Best Practice: Get Markdown URLs to display as URLs instead of strings when using groupBy()

If you have a field that contains a Markdown URL as the value, you may want that displayed as a clickable URL in the groupBy() output. To do so, you must remove the field from the collect() function and place it into a selectLast() instead. This last step prevents you from collecting multiple URLs into the same field.

Here is an example:

| groupBy([aid, ParentProcessId], function=[collect([ComputerName, UserName, ParentProcessId, ParentBaseFileName, FileName, CommandLine], limit=10000), count(FileName, as="FileNameCount"), count(CommandLine, as="CommandLineCount"), selectLast("Process Explorer")], limit=max)

The results look like this: