Query syntax fix

Author: JV0812

docs/integrations/amazon-aws/cost-explorer.md

@@ -70,7 +70,7 @@ Create a Field Extraction Rule (FER) for AWS Cost Explorer Logs. Learn how to cr
   ```
 * **Parse Expression:** Enter a parse expression to create an “account” field that maps to the alias you set for each sub account. For example, if you used the “securityprod” alias for an AWS account with ID "123456789" and the “infraprod” alias for an AWS account with ID "987654321", your parse expression would look like:
   ```sql
-  json "LinkedAccount"
+  | json "LinkedAccount"
   | if (LinkedAccount = "123456789",  "securityprod", LinkedAccount ) as LinkedAccount
   | if (LinkedAccount = "987654321",  "infraprod", LinkedAccount ) as LinkedAccount
   ```

docs/integrations/security-threat-detection/crowdstrike-falcon-endpoint-protection.md

@@ -178,7 +178,7 @@ _sourceCategory=*Crowdstrike*  DetectionSummaryEvent
 _sourceCategory=*Crowdstrike*  AuthActivityAuditEvent (userAuthenticate or twoFactorAuthenticate)
 | json "metadata.eventType", "metadata.customerIDString", "metadata.eventCreationTime" as event_type, customer_id, event_time
 | formatDate(fromMillis(event_time), "MM/dd/yyyy HH:mm:ss:SSS") as event_time
-| json "event.UserId", "event.UserIp", "event.OperationName", "event.ServiceName", "event.Success", "event.UTCTimestamp" as src_user, user_ip, operation_name, service_name, success, operation_tim
+| json "event.UserId", "event.UserIp", "event.OperationName", "event.ServiceName", "event.Success", "event.UTCTimestamp" as src_user, user_ip, operation_name, service_name, success, operation_time
 | formatDate(fromMillis(operation_time), "MM/dd/yyyy HH:mm:ss:SSS") as operation_time
 | where success="true"
 | count by operation_time, operation_name, src_user, user_ip

docs/metrics/metrics-operators/filter.md

@@ -53,7 +53,7 @@ The supported functions are:
 Return the time series in which the average value of the CPU_User metric is greater than 95:
 
 ```sql
-metric=CPU_User | filter avg > 95`
+metric=CPU_User | filter avg > 95
 ```
 
 **Example 2**