我有这3张桌子,
tbl_1-
ip |isp |infection
----------------------
1 |aaaa |malware
2 |bbbb |malware
3 |cccc |ddos
3 |cccc |trojan
4 |dddd |ddos
tbl_2-
ip |isp |infection
----------------------
1 |aaaa |malware
3 |cccc |ddos
4 |dddd |trojan
5 |eeee |trojan
6 |ffff |other
tbl_3-
ip |isp |infection
----------------------
1 |aaaa |ddos
6 |ffff |
2 |bbbb |other
我需要得到如下结果,
result-
ip |isp |infection |ipCount |ispCount |infectionCount
--------------------------------------------------------------
1 |aaaa |malware |3 |3 |2
1 |aaaa |ddos |3 |3 |1
2 |bbbb |other |2 |2 |1
2 |bbbb |malware |2 |2 |1
3 |cccc |ddos |3 |3 |2
3 |cccc |trojan |3 |3 |1
4 |dddd |ddos |2 |2 |1
4 |dddd |trojan |2 |2 |1
5 |eeee |trojan |1 |1 |1
6 |ffff |other |2 |2 |1
6 |ffff | |2 |2 |1
ipCount, ispCount -> count of matching ip and isp
eg-there are 3 records with ip = 1 and isp = aaaa
infectionCount -> count of matching infections per ip and isp
eg-there are 2 infections that says malware where ip = 1 and isp = aaaa
我想我需要一个嵌套的查询,但我不知道如何计算两个条件;你能帮忙吗?
编辑:我尝试过的代码,
SELECT ip, isp, infection, count(ip), count(isp), count(infection)
FROM (
SELECT ip, isp, infection
FROM tbl_1
UNION ALL
SELECT ip, isp, infectionType
FROM tbl_2
UNION ALL
SELECT ip, isp, infection
FROM tbl_3
)x
GROUP BY ip, isp, infection
但它没有给出我想要的结果因为我不知道如何在一个查询中做两种类型的计数
答案 0 :(得分:3)
您需要对列infection
和(ip
& ipc
)进行不同的分组,然后使用以下子查询加入它们:
SELECT t1.ip, t1.isp, t2.infection, t1.ipc, t1. ispc, t2.incount
FROM
(SELECT ip, isp, infection, COUNT(ip) as ipc, COUNT(isp) as ispc
FROM (
SELECT ip, isp, infection
FROM tbl1
UNION ALL
SELECT ip, isp, infection
FROM tbl2
UNION ALL
SELECT ip, isp, infection
FROM tbl3
)x
GROUP BY ip, isp) t1
JOIN
(SELECT ip, isp, infection, COUNT(infection) as incount
FROM (
SELECT ip, isp, infection
FROM tbl1
UNION ALL
SELECT ip, isp, infection
FROM tbl2
UNION ALL
SELECT ip, isp, infection
FROM tbl3
)x
GROUP BY ip, isp, infection)t2
ON t1.ip = t2.ip
ORDER BY ip, isp, infection Desc
注意:我认为您想要的输出是错误的,因为:
Table3
中infection
没有ip=6
,但它在您的输出中infection
other
(而不是malware
)