"SELECT\n JSONExtractString(arrayJoin(result_risk), 'RiskName') `access_airline_view__risk`, count(`access_airline_view`.id) `access_airline_view__count`\n FROM\n default.access AS `access_airline_view` WHERE (`access_airline_view`.ts >= parseDateTimeBestEffort(?) AND `access_airline_view`.ts <= parseDateTimeBestEffort(?)) GROUP BY `access_airline_view__risk` ORDER BY `access_airline_view__count` DESC LIMIT 10000",
[
"2022-03-28T16:00:00Z",
"2022-03-29T15:59:59Z" ]