Jim Harbin

Report Aggregate Fields used in SQL Query

Discussion created by Jim Harbin on May 16, 2011
Latest reply on Jun 3, 2011 by RSA Admin

In the list of fields that you can pick for a reports, aggregated fields (count, percent, etc..) are there.  How can I use those aggregated values in my report sql query?

i.e.  count(sourceaddress) is chosen in the field list.  I want my SQL query to be “count(sourceaddress) > 5” but when I try to use it it gives me an aggregated value error.  Are these aggregated values assigned to an alias that I can use in the SQL query or how do I constrain by report results based upon their value? 


The closest feature that I see built in is the “Return top X results” option, but that doesn’t give me the same end result.