Question

是SQl的新手，我编写了一个查询以从事件数据库中提取事件报告，该数据库根据事件槽信息将每个事件的数据存储在不同的表中。
下表是

EVENT_D

ID     HOST       MESSAGE 
---------- ----------------- 
ID1    server1    Server Down
ID2    server2    File System Issue

EVENT_INFO

ID    RECEIVED_TIME          
---------- -------------
ID1   03-05-2019 12:09PM
ID2   03-06-2019 03:00AM

EVENT_OPERATIONS

ID     EG_TIME               EG_OPERATION 
---------- ------------------------------- 
ID1    03-05-2019 12:10 PM    Blacked Out
ID1    03-05-2019 12:10 PM    Reopened
ID1    03-05-2019 12:13 PM    Ownership Taken
ID1    03-05-2019 12:50 PM    Closed
ID2    03-06-2019 03:05 AM    Rule applied
ID2    03-06-2019 03:06 AM    Ownership Taken
ID2    03-06-2019 03:07 AM    Ticket triggered
ID2    03-06-2019 03:30 AM    Closed

预期输出：

ID     HOST       MESSAGE               RECEIVED_TIME           Operations
---------- ------------------------------------------------------------------------------------------------------------------------------------- 
ID1    server1    Server Down           03-05-2019 12:09PM      Blacked Out 03-05-2019 12:10 PM; Reopened 03-05-2019 12:10 PM; Ownership Taken 03-05-2019 12:13 PM; Closed 03-05-2019 12:50 PM
ID2    server2    File System Issue     03-06-2019 03:00AM      Rule applied 03-06-2019 03:05 AM; Ownership Taken 03-06-2019 03:06 AM; Ticket triggered 03-06-2019 03:07 AM; Closed 03-06-2019 03:30 AM

使用的查询：

  SELECT a.ID          AS Event_ID,
         a.HOST        AS Hostname,
         a.MESSAGE     AS EventMessage,
         b.RECEIVED_TIME AS EventReception,
         LISTAGG (
             c.EG_OPERATION || TO_CHAR (c.EG_TIME, 'YYYY-MM-DD hh12:mi:ss AM'),
             ';')
         WITHIN GROUP (ORDER BY c.EG_TIME) as Operations
    FROM EVENT_D a
         INNER JOIN EVENT_INFO b ON b.ID = a.ID
         INNER JOIN EVENT_OPERATIONS c ON c.ID = a.ID
   WHERE     b.RECEIVED_TIME >= TO_DATE ('2019-03-01', 'YYYY-MM-DD hh24:mi:ss')
         AND b.RECEIVED_TIME < TO_DATE ('2019-03-04', 'YYYY-MM-DD hh24:mi:ss')
GROUP BY a.ID,
         a.HOST,
         a.MESSAGE,
         b.RECEIVED_TIME

问题：

如果执行查询时没有 listagg / xmlagg 函数和 groupby   表达式输出中的记录数约为每条记录6000条   天（在实际情况下）。但是由于在 groupby 表达式中使用了   上面的查询在事件计数中有一个未命中匹配项。大事记   按主机，消息和其他插槽分组   影响计数。在实际情况下，我们将获得约600条记录，而不是6000条记录。

问题：除了listagg / xmlagg之外，还有其他任何功能可以向我们提供预期格式的输出。

Answer 1

也许您希望LISTAGG()作为窗口函数：

SELECT . . .,
       LISTAGG (c.EG_OPERATION || TO_CHAR (c.EG_TIME, 'YYYY-MM-DD hh12:mi:ss AM'),
                ';'
               ) WITHIN GROUP (ORDER BY c.EG_TIME) OVER (PARTITION BY ID, HOST) as Operations

然后您将删除GROUP BY。

SQL函数类似于xmlagg或listagg

1 个答案: