Reference
Groupby
The groupby pipe helps organize data in groups and calculate aggregate statistics for those groups.
Updated 2026-08-17
Groupby
The groupby pipe will help you organize data in groups and calculate some kind of aggregate statistics for these mentioned groups. It basically groups rows with the same value into one group or bucket. Let's see how it works.
The following syntax shows the position of the Groupby Clause in a query.
stream=firewall | groupby dstcnThe above query will group the results as per destination country for each event where the stream is firewall as shown below:
Related
Was this page helpful?