Which SQL query is in the correct order to query the database in the FortiAnalyzer?

Which SQL query is in the correct order to query the database in the FortiAnalyzer?

A. SELECT devid WHERE /'user/'=/'USER1/' FROM $log GROUP BY devid B. FROM $log WHERE /'user/'=/'USER1/' SELECT devid GROUP BY devid C. SELECT devid FROM $log WHERE /'user/'=/'USER1/' GROUP BY devid D. SELECT devid FROM $log GROUP BY devid WHERE /'user/'=/'USER1/'