这是我的包含日志的表:
message | data
----------------------------------------------
ttt,tu10=UP,tu20=UP | 2016-11-11 10:15:05
ttt,tu10=DOWN,tu20=DOWN | 2016-11-11 10:13:05
ttt,oper=UP,oper2=UP | 2016-11-11 10:13:01
ttt,oper=DOWN,oper2=DOWN | 2016-11-11 10:07:05
hhh,tu10=UP,tu20=UP | 2016-11-11 10:05:04
hhh,tu10=DOWN,tu20=DOWN | 2016-11-11 10:05:01
hhh,tu10=DOWN,tu20=DOWN | 2016-11-11 09:43:01
hhh,tu10=UP,tu20=UP | 2016-11-11 09:37:04
hhh,tu10=DOWN,tu20=DOWN | 2016-11-11 09:35:05
ttt,tu10=DOWN,tu20=DOWN | 2016-11-11 09:35:01
ttt,tu10=UP,tu20=UP | 2016-11-11 09:33:05
ttt,tu10=DOWN,tu20=DOWN | 2016-11-11 05:35:01
hhh,tu10=UP,tu20=UP | 2016-11-11 05:33:05我创建了这个查询:
SELECT *
FROM (
SELECT
*,COUNT(*) AS count
FROM log
WHERE data > DATE_SUB(NOW(), INTERVAL 2 HOUR)
GROUP BY substring_index(message,',',1)
) AS tmp
WHERE count > 3屏幕上打印:'message','data','count‘
获取类似以下内容:
ttt,tu10=UP,tu20=UP | 2016-11-11 09:33:05 | 6
hhh,tu10=DOWN,tu20=DOWN | 2016-11-11 09:35:05 | 5我想得到第一个,就像这样:
ttt,tu10=UP,tu20=UP | 2016-11-11 10:15:05 | 6
hhh,tu10=UP,tu20=UP | 2016-11-11 10:05:04 | 5我试过几种排序的方法,但我放弃了。
发布于 2016-11-11 19:21:08
为此,我建议使用substring_index()/group_concat()技巧:
SELECT SUBSTRING_INDEX(GROUP_CONCAT(message ORDER BY data DESC SEPARATOR '|'), '|', 1) as message,
MAX(data) as data, COUNT(*) AS count
FROM log l
WHERE data > DATE_SUB(NOW(), INTERVAL 2 HOUR)
GROUP BY substring_index(message, ',', 1)
HAVING COUNT(*) >= 3;请注意,GROUP_CONCAT()具有由系统变量设置的内部限制,默认值为1,024。如果消息长度超过该长度,则会生成错误。您可以重置长度。
另一种选择是:
select l.*
from (select substring_index(message, ',', 1) as m1, max(data) as maxd
from log
group by substring_index(message, ',', 1)
having count(*) >= 3
) ll join
l
on ll.m1 = substring_index(l.message, ',', 1) and ll.maxd = l.datahttps://stackoverflow.com/questions/40545932
复制相似问题