|
PQL query using the array-form 'in' operator as below will fail because the output of the aggregate function min() is a field named 'min', not 'receive_time':
reports { [certname, receive_time] in reports [certname, min(receive_time)] { certname ~ "foo" group by certname }
}
can we either match fields by position in the array (poor), position and type (better) or provide SQL-like aliases in the second array as in:
[certname, receive_time] in reports [certname, min(receive_time) as receive_time]
|