使用两个条件获取计数的嵌套查询 [英] Nested queries to get count with two conditions

问题描述

我有这 3 张桌子，

tbl_1-
ip  |isp    |infection
----------------------
1   |aaaa   |malware
2   |bbbb   |malware
3   |cccc   |ddos
3   |cccc   |trojan
4   |dddd   |ddos

tbl_2-
ip  |isp    |infection
----------------------
1   |aaaa   |malware
3   |cccc   |ddos
4   |dddd   |trojan
5   |eeee   |trojan
6   |ffff   |other

tbl_3-
ip  |isp    |infection
----------------------
1   |aaaa   |ddos
6   |ffff   |
2   |bbbb   |other

我需要得到如下结果，

result-
ip  |isp    |infection  |ipCount    |ispCount   |infectionCount
--------------------------------------------------------------
1   |aaaa   |malware    |3          |3          |2
1   |aaaa   |ddos       |3          |3          |1
2   |bbbb   |other      |2          |2          |1
2   |bbbb   |malware    |2          |2          |1
3   |cccc   |ddos       |3          |3          |2
3   |cccc   |trojan     |3          |3          |1
4   |dddd   |ddos       |2          |2          |1
4   |dddd   |trojan     |2          |2          |1
5   |eeee   |trojan     |1          |1          |1
6   |ffff   |other      |2          |2          |1
6   |ffff   |           |2          |2          |1

ipCount, ispCount -> count of matching ip and isp
    eg-there are 3 records with ip = 1 and isp = aaaa

infectionCount -> count of matching infections per ip and isp
    eg-there are 2 infections that says malware where ip = 1 and isp = aaaa

我想我需要一个嵌套的查询，但我不知道如何用两个条件进行计数；你能帮忙吗?

I think I need a nested a query but I don't know how to count with two conditions; can you help?

编辑:我试过的代码，

SELECT ip, isp, infection, count(ip), count(isp), count(infection)
FROM (

SELECT ip, isp, infection
FROM tbl_1
UNION ALL
SELECT ip, isp, infectionType
FROM tbl_2
UNION ALL
SELECT ip, isp, infection
FROM tbl_3
)x

GROUP BY ip, isp, infection

但它没有给出我想要的结果，因为我不知道如何在一个查询中进行两种类型的计数

But it doesnt give the result I desire cause I don't know how to do 2 types of counts in one query

推荐答案

您需要将列infection 和 (ip & ipc) 不同，然后使用这样的子查询加入它们:

You need to group column infection and (ip & ipc) differently then join them using sub-query like this:

SELECT t1.ip, t1.isp, t2.infection, t1.ipc, t1. ispc, t2.incount
FROM
    (SELECT ip, isp, infection, COUNT(ip) as ipc, COUNT(isp) as ispc
    FROM (
       SELECT ip, isp, infection
       FROM tbl1
       UNION ALL
       SELECT ip, isp, infection
       FROM tbl2
       UNION ALL
       SELECT ip, isp, infection
       FROM tbl3
       )x
     GROUP BY ip, isp) t1
JOIN
    (SELECT ip, isp, infection, COUNT(infection) as incount
     FROM (
       SELECT ip, isp, infection
       FROM tbl1
       UNION ALL
       SELECT ip, isp, infection
       FROM tbl2
       UNION ALL
       SELECT ip, isp, infection
       FROM tbl3
       )x
    GROUP BY ip, isp,  infection)t2
ON t1.ip = t2.ip
ORDER BY ip, isp, infection Desc

查看此 SQLFiddle

注意:我认为您想要的输出是错误的，因为:

See this SQLFiddle

Note: I think your desired output is wrong because:

1. 在 Table3 中，ip=6 没有 infection，但它在您的输出中
2. infection other 在您的输出中丢失(而是恶意软件)

1. In Table3 there is no infection for ip=6 but it is in your output
2. infection other is missing in your output (instead there is malware)

这篇关于使用两个条件获取计数的嵌套查询的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！