I cant get a Query to work right. Arcsight says my syntax is wrong

[aur31ius1]

SELECT events.arc_deviceAction

events.COUNT(DISTINCT events.arc_deviceAction) attempts

FROM events

WHERE events.arc_deviceVendor = Snort

AND events.arc_deviceVendor = CISCO

AND events.arc_deviceVendor = Mcafee

AND events.arc_deviceVendor = Juniper

GROUP BY events.arc_deviceAction

[mmaul]

SELECT events.arc_deviceAction,

COUNT(DISTINCT events.arc_deviceAction)  attempts

FROM events

WHERE events.arc_deviceVendor = 'Snort'

AND events.arc_deviceVendor = 'CISCO'

AND events.arc_deviceVendor = 'Mcafee'

AND events.arc_deviceVendor = 'Juniper'

GROUP BY events.arc_deviceAction

[rhope]

You've fixed the syntax error, but not the logic error, it should be OR and not and for the arc_deviceVendor (the events will only have one vendor). I'm also guessing that the DISTINCT isn't actually what the OP wants, the query will just return each deviceAction with a count of 1.

SELECT events.arc_deviceAction,

COUNT(events.arc_deviceAction)  attempts

FROM events

WHERE (events.arc_deviceVendor = 'Snort'

OR events.arc_deviceVendor = 'CISCO'

OR events.arc_deviceVendor = 'Mcafee'

OR events.arc_deviceVendor = 'Juniper')

GROUP BY events.arc_deviceAction