Issuing QueryItems() with DISTINCT and ORDER BY together like below does not work and will yield duplicate results.
SELECT DISTINCT c.FirstSeen, c.ConfigSha256
FROM c
WHERE c.FirstSeen >= '2020-02-12T19:50:43'
ORDER BY c.FirstSeen DESC
Removing the ORDER BY the result returned distinct records
The portal's data explorer was not affected. Only if you are running via python SDK.
Issuing QueryItems() with DISTINCT and ORDER BY together like below does not work and will yield duplicate results. SELECT DISTINCT c.FirstSeen, c.ConfigSha256 FROM c WHERE c.FirstSeen >= '2020-02-12T19:50:43' ORDER BY c.FirstSeen DESC
Removing the ORDER BY the result returned distinct records The portal's data explorer was not affected. Only if you are running via python SDK.