> select serial_no, count(*) as "restarts" from event_log where event_mesg ilike 'system sta%' and event_date > current_date - 7> group by serial_no> having count(*) > X> order by restartsI think having is the better option.