LogParser date-time with another fields

tomascorey  I'm no expert but I think your raw date-time field values mightn't be recognized datetime format.  I had a look at my only saved LogParser queries, here:

https://github.com/JeremyTBradshaw/PowerShell/blob/master/LogParser/GetEwsUsers.ps1

I would have copied from other example to come up with this:

SELECT TO_STRING(TO_TIMESTAMP(EXTRACT_PREFIX(REPLACE_STR([#Fields: datetime],'T',' '),0,'.'), 'yyyy-MM-dd hh:mm:ss'),'yyMMdd') AS Day

The datetime field in my case is being manipulated by TO_TIMESTAMP and then TO_STRING.  My source logs are EWS logs from Exchange, and I don't know what log types you're looking at, so hopefully this helps.  Mainly what I'm trying to point out is that in your code, you're just grabbing date-time and keeping it as it is, and that seems to not be a recognized datetime format that can be grouped by.