I have reported the lack of the support as an issue to the development team.
However, you may re-formulate the query so you wrap the basis of the query in the subquery and put the HAVING clause as a WHERE clause of the outer query. I.e.:
SELECT NodeID, SourceIP, DestinationIP, SumA
SELECT NodeID, SourceIP, DestinationIP, SUM(TotalBytes) AS SumA
GROUP BY NodeID, SourceIP, DestinationIP
Does this help?
thanks for reporting this back to the dev team and for the feedback!
the actual query is more complicated and the concern is the performance impact with multiple SELECT statements. while this will work for now, I'm really looking forward to seeing more clauses included in SWQL
Installation | Consultancy | Training | Licenses