diff --git a/lib/xapi.js b/lib/xapi.js
index aef5cdfbcd..d6c14b9372 100644
--- a/lib/xapi.js
+++ b/lib/xapi.js
@@ -482,21 +482,27 @@ class Xapi {
     if (req.query && req.query._fields) {
 
       let queryParamsObj = {}
-      queryParamsObj.query = '';
+      queryParamsObj.query = 'select ';
       queryParamsObj.params = [];
 
-      queryParamsObj.query = 'select ' + req.query._fields + ',count(*) as _count from ?? group by ' + req.query._fields;
+      /**************** add columns and group by columns ****************/
+      this.mysql.getColumnsForSelectStmt(req.app.locals._tableName,req.query,queryParamsObj)
+
+      queryParamsObj.query += ',count(*) as _count from ?? group by ';
       let tableName = req.app.locals._tableName;
       queryParamsObj.params.push(tableName);
 
+      this.mysql.getColumnsForSelectStmt(req.app.locals._tableName,req.query,queryParamsObj)
+
       if (!req.query._sort) {
         req.query._sort = {}
         req.query._sort = '-_count'
       }
 
-      /**************** where clause ****************/
+      /**************** add having clause ****************/
       this.mysql.getHavingClause(req.query._having, req.app.locals._tableName, queryParamsObj, ' having ');
 
+      /**************** add orderby clause ****************/
       this.mysql.getOrderByClause(req.query, tableName, queryParamsObj);
 
       //console.log(queryParamsObj.query, queryParamsObj.params);