Advanced Searches in QRadar. Part 1: Introduction

QRadar UI is very intuitive, but some times you need to do things that the UI does not offer you. The flexibility of doing sophisticated searches is now available in QRadar 7.2.3.
A file with the links to all my recent videos can be found here:
Qradar, Arcsight, RSA, Nitro, LogRhythm, "Allien Vault", "solar winds", splunk, "rule correlation", correlation, rule, troubleshooting, debugging, offense, mutaz, "network hierarchy", replay, "replay logs", "false positives", "case sensitivity", siem, "security intelligence", "multi test rules", "qradar rules"

[umerahmed]

Hi Josh, I want help from you. I want to make a report of system health using AQL in which columns are elements, hostname, metricID (DiskSpaceUsed) and ('DiskSpaceTotal).
Following is the Query, I have an issue in that query it return actual data but return 2 rows of same columns, group by not working, kindly help me please

SELECT "Hostname", element AS Partiton_Name, MAX(value/(1024*1024*1024)) AS 'DiskUsedInGB', max(value/(1024*1024*1024)) AS 'DiskTotalSpace'
FROM events
WHERE LOGSOURCENAME(logsourceid)
ILIKE '%%health%%' AND "Metric ID"='DiskSpaceUsed' OR "Metric ID"='DiskSpaceTotal' GROUP BY element, "Metric ID"
LAST 2 MINUTES

Let me know if have any question
Thanks