我是SQl的新手,我编写了一个查询来从事件数据库中提取事件报告,其中每个事件的数据根据事件槽信息存储在不同的表中。 以下是表格:
EVENT_D
ID HOST MESSAGE
---------- -----------------
ID1 server1 Server Down
ID2 server2 File System Issue
EVENT_INFO
ID RECEIVED_TIME
---------- -------------
ID1 03-05-2019 12:09PM
ID2 03-06-2019 03:00AM
EVENT_OPERATIONS
ID EG_TIME EG_OPERATION
---------- -------------------------------
ID1 03-05-2019 12:10 PM Blacked Out
ID1 03-05-2019 12:10 PM Reopened
ID1 03-05-2019 12:13 PM Ownership Taken
ID1 03-05-2019 12:50 PM Closed
ID2 03-06-2019 03:05 AM Rule applied
ID2 03-06-2019 03:06 AM Ownership Taken
ID2 03-06-2019 03:07 AM Ticket triggered
ID2 03-06-2019 03:30 AM Closed
预期产出:
ID HOST MESSAGE RECEIVED_TIME Operations
---------- -------------------------------------------------------------------------------------------------------------------------------------
ID1 server1 Server Down 03-05-2019 12:09PM Blacked Out 03-05-2019 12:10 PM; Reopened 03-05-2019 12:10 PM; Ownership Taken 03-05-2019 12:13 PM; Closed 03-05-2019 12:50 PM
ID2 server2 File System Issue 03-06-2019 03:00AM Rule applied 03-06-2019 03:05 AM; Ownership Taken 03-06-2019 03:06 AM; Ticket triggered 03-06-2019 03:07 AM; Closed 03-06-2019 03:30 AM
使用的查询:
SELECT a.ID AS Event_ID,
a.HOST AS Hostname,
a.MESSAGE AS EventMessage,
b.RECEIVED_TIME AS EventReception,
LISTAGG (
c.EG_OPERATION || TO_CHAR (c.EG_TIME, 'YYYY-MM-DD hh12:mi:ss AM'),
';')
WITHIN GROUP (ORDER BY c.EG_TIME) as Operations
FROM EVENT_D a
INNER JOIN EVENT_INFO b ON b.ID = a.ID
INNER JOIN EVENT_OPERATIONS c ON c.ID = a.ID
WHERE b.RECEIVED_TIME >= TO_DATE ('2019-03-01', 'YYYY-MM-DD hh24:mi:ss')
AND b.RECEIVED_TIME < TO_DATE ('2019-03-04', 'YYYY-MM-DD hh24:mi:ss')
GROUP BY a.ID,
a.HOST,
a.MESSAGE,
b.RECEIVED_TIME
问题:
如果在没有listagg / xmlagg函数和groupby表达式的情况下执行查询,则输出中的记录数量将为每天6000左右(在实际情况下)。但由于在上述查询中使用了groupby表达式,因此事件计数中存在未命中匹配。事件按主机,消息和其他插槽分组,这反过来影响计数。在实际案例中,我们获得了大约600条记录,而不是6000条记录。
问题:除了listagg / xmlagg之外还有其他功能可以为我们提供预期格式的输出。
也许你想要LISTAGG()
作为窗函数:
SELECT . . .,
LISTAGG (c.EG_OPERATION || TO_CHAR (c.EG_TIME, 'YYYY-MM-DD hh12:mi:ss AM'),
';'
) WITHIN GROUP (ORDER BY c.EG_TIME) OVER (PARTITION BY ID, HOST) as Operations
然后你会删除GROUP BY
。