我正在从SCOM SQL服务器提取警报
我在警报复制方面遇到了一些问题,因为每次警报状态更改时(例如,从新更改为确认),都会在数据库上创建一个具有相同alert_id的新条目。
因此,我试图根据最高警报状态(0表示新,100确认,255表示已关闭)对这些alert_id进行重复数据删除。
例如:
row alert_id alert_timeraised ResolutionState
1 4B77E4A8-61F9-4696-A4C0-00076EDACCE7 2019-06-24 0
2 4B77E4A8-61F9-4696-A4C0-00076EDACCE7 2019-06-24 100
3 4B77E4A8-61F9-4696-A4C0-00076EDACCE7 2019-06-24 255
4 C6BF2104-767D-43E0-B356-000B30570312 2019-07-07 255
5 C6BF2104-767D-43E0-B356-000B30570312 2019-07-07 0
对于第1行和第2行(相同的alert_id),我只想选择“ ResolutionState”值(255)高的行
我尝试过的事情:
GROUP BY语句(每次我得到不同的计数...)
SELECT UNIQUE(根本不起作用)
选择
这是SQL查询:
SELECT
Alert.vAlert.AlertGuid AS 'alert_id',
Alert.vAlertResolutionState.StateSetDateTime AS 'alert_timeraised',
ResolutionState
FROM
Alert.vAlertDetail WITH (NOLOCK)
INNER JOIN Alert.vAlert WITH (NOLOCK) ON Alert.vAlertDetail.AlertGuid = Alert.vAlert.AlertGuid
INNER JOIN Alert.vAlertResolutionState ON Alert.vAlert.AlertGuid = Alert.vAlertResolutionState.AlertGuid
GROUP BY
Alert.vAlert.AlertGuid,
Alert.vAlertResolutionState.StateSetDateTime,
Alert.vAlertResolutionState.ResolutionState
UNION
SELECT
Alert.vAlert.AlertGuid,
CONVERT(VARCHAR(50), Alert.vAlertResolutionState.StateSetDateTime, 20),
ResolutionState
FROM
Alert.vAlertDetail WITH (NOLOCK)
INNER JOIN Alert.vAlert WITH (NOLOCK) ON Alert.vAlertDetail.AlertGuid = Alert.vAlert.AlertGuid
INNER JOIN Alert.vAlertResolutionState ON Alert.vAlert.AlertGuid = Alert.vAlertResolutionState.AlertGuid
GROUP BY
Alert.vAlert.AlertGuid,
Alert.vAlertResolutionState.StateSetDateTime,
Alert.vAlertResolutionState.ResolutionState
ORDER BY alert_id asc
非常感谢您对此有任何建议。