Improve structure and readability of boot time query

[socketz]

Refactor CQL to enhance clarity and organization of Windows OS boot time query.

[Copilot]

Pull request overview

Refactors the LogScale/CQL example query used to calculate Windows OS boot time and uptime from AgentOnline events, aiming to improve readability and organization.

Changes:

• Reordered/expanded steps in the query (added an explicit rounding step for realBootTime).
• Adjusted the aggregation to group by both aid and ComputerName.
• Minor formatting cleanup within the markdown code block.

Comments suppressed due to low confidence (2)

Queries-Only/Helpful-CQL-Queries/Get Windows OS Boot Time.md:18

• This comment has a typo: "Crate" → "Create". Since this section explains the output structure, fixing it helps readability.

// Crate groupBy to organize output
| groupBy([aid, ComputerName], function=([selectLast([realBootTime,uptimeDays])]))

Queries-Only/Helpful-CQL-Queries/Get Windows OS Boot Time.md:18

• The PR description says this is a refactor for readability, but changing groupBy from aid-only to [aid, ComputerName] alters the result shape and can increase row count (e.g., if ComputerName changes over time for the same aid). If the goal is to show ComputerName without changing grouping semantics, consider keeping groupBy([aid]) and selecting the latest ComputerName inside selectLast/selectFromMax instead.

| groupBy([aid, ComputerName], function=([selectLast([realBootTime,uptimeDays])]))

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.