> select serial_no, count(*) as "restarts" from event_log where event_mesg ilike 'system sta%' and event_date > current_date - 7> group by serial_no
> having count(*) > X
> order by restarts
I think having is the better option.
