Question

也许我正在让它变得更加复杂，希望有人可以指出我正确的方向。我非常接近这个查询：

SELECT 
    Action, TimeOccurred, 
    COUNT(Action) 
FROM 
    [].[dbo].[] 
WHERE 
    Action LIKE '%Logon Failed%' 
    AND (DATEDIFF(day, TimeOccurred, GETDATE()) BETWEEN 0 AND 30) 
GROUP BY
    Action, TimeOccurred 
ORDER BY
    TimeOccurred

我的问题是TimeOccurred格式如下：2017-05-13 00:02:00所以现在不是每天给我所有“登录失败”事件，而是每小时/分钟/秒。

我想基本上削减hh：mm：ss，所以我的结果是每天。希望这是有道理的。

Answer 1

您可以convert()到date截断datetime数据类型的时间部分。

select 
    Action
  , TimeOccurred = convert(date,TimeOccurred )
  , Count(Action)
from [].[dbo].[]
where Action like '%Logon Failed%' 
  and TimeOccured >= dateadd(day,-30,dateadd(day, datediff(day, 0, getdate()), 0))
group by Action
  , convert(date,TimeOccurred)
order by TimeOccurred

对于where，您可以计算30天前的日期，而不是获得datediff()并将该范围限制为0-30。

对于条件聚合，你可以这样做：

select 
    TimeOccurred    = convert(date, TimeOccurred)
  , logon_kerberos  = count (case when Action like ' %logon (kerberos)%' then 1 end)
  , logon_local_wts = count (case when Action like ' %logon (local/wts)%' then 1 end)
  , logon_ntlm      = count (case when Action like ' %logon (ntlm)%' then 1 end)
  , logon_total     = count (case when Action like ' %logon (%' then 1 end)
  , Count(Action)
from [CPTRAX_for_Windows].[dbo].[Logon_Logoff_and_Failed_Logon_Profiles]
where Action like '%Logon (%' 
  and TimeOccurred >= dateadd(day, -30, dateadd(day, datediff(day, 0, getdate()), 0))
group by convert(date, TimeOccurred)
order by TimeOccurred

您可以使用日历或日期表进行此类操作。

对于内存中只有152kb，您可以在表格中拥有30年的日期：

/* dates table */
declare @fromdate date = '20000101';
declare @years    int  = 30;
/* 30 years, 19 used data pages ~152kb in memory, ~264kb on disk */
;with n as (select n from (values(0),(1),(2),(3),(4),(5),(6),(7),(8),(9)) t(n))
select top (datediff(day, @fromdate,dateadd(year,@years,@fromdate)))
    [Date]=convert(date,dateadd(day,row_number() over(order by (select 1))-1,@fromdate))
into dbo.Dates
from n as deka cross join n as hecto cross join n as kilo
               cross join n as tenK cross join n as hundredK
order by [Date];
create unique clustered index ix_dbo_Dates_date
  on dbo.Dates([Date]);

如果不采取创建表格的实际步骤，您可以在common table expression内使用它：

declare @fromdate date = dateadd(day  , datediff(day  , 0, getdate() )-30 , 0); 
declare @thrudate date = dateadd(day  , datediff(day  , 0, getdate() ), 0);
;with n as (select n from (values(0),(1),(2),(3),(4),(5),(6),(7),(8),(9)) t(n))
, dates as (
  select top (datediff(day, @fromdate, @thrudate)+1) 
      [Date]=convert(date,dateadd(day,row_number() over(order by (select 1))-1,@fromdate))
  from n as deka cross join n as hecto cross join n as kilo
                cross join n as tenK cross join n as hundredK
   order by [Date]
)
select [Date]
from dates;

使用如下：

select 
    TimeOccurred    = d.Date
  , logon_kerberos  = count (case when Action like ' %logon (kerberos)%' then 1 end)
  , logon_local_wts = count (case when Action like ' %logon (local/wts)%' then 1 end)
  , logon_ntlm      = count (case when Action like ' %logon (ntlm)%' then 1 end)
  , logon_total     = count (case when Action like ' %logon (%' then 1 end)
  , Count(Action)
from Dates d
  left join [CPTRAX_for_Windows].[dbo].[Logon_Logoff_and_Failed_Logon_Profiles] l
    on d.Date = convert(date,l.TimeOccured)
   and l.Action like '%Logon (%' 
 where d.Date >= dateadd(day, -30, dateadd(day, datediff(day, 0, getdate()), 0))
group by d.Date
order by d.Date

数字和日历表参考：

SQL Server查询每天事件数

1 个答案: