TSQL OrderedTable

所以我正在查询一些数据并试图确定每个用户登录和注销之间的时间量。我接近得到这个，但得到的结果不起作用。这里是我现在所拥有的代码：TSQL OrderedTable

WITH OrderedTable AS 
(
SELECT EventType 
     , ModuleAndEventText 
     , Time 
     , Node 
     , UserSID 
     , ROW_Number() OVER (Partition BY UserSID ORDER BY UserSID,EventID,Time) RN 
FROM viewevent 
where EventType in ('BROKER_USERLOGGEDIN','BROKER_USERLOGGEDOUT') and usersid = 'S-1-5-21-999033763-294680432-740312968-10026' 
) 

SELECT t1.EventType 
    , t1.ModuleAndEventText 
    , t1.Node 
    , t1.UserSID 
    , t1.Time as TimeIn 
    , t2.Time as TimeOut 
    , DATEDIFF(hour, t1.Time, t2.Time) TimeElapsedInHours 
FROM OrderedTable t1 
JOIN OrderedTable t2 ON t1.UserSID = t2.UserSID AND t2.RN = t1.RN + 1 
WHERE t1.RN % 2 <> 0 
ORDER BY t1.UserSID

这里有一些我得到的结果：

BROKER_USERLOGGEDIN  User YRMC_MAIN\jerogers has logged in VMVIEWTC1.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 2012-04-14 08:00:36.137 2012-04-14 09:32:08.267  1 
BROKER_USERLOGGEDIN  User YRMC_MAIN\jerogers has logged in VMVIEWTC1.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 2012-04-14 08:00:36.137 2012-04-14 09:32:08.267  1 
BROKER_USERLOGGEDIN  User YRMC_MAIN\jerogers has logged in VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 2012-06-11 14:50:40.420 2012-06-11 16:43:08.640  2 
BROKER_USERLOGGEDIN  User YRMC_MAIN\jerogers has logged in VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 2012-06-11 17:49:46.330 2012-06-11 18:42:50.047  1 
BROKER_USERLOGGEDOUT User YRMC_MAIN\jerogers has logged out VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 2012-06-11 18:59:40.550 2012-06-12 23:20:16.027  29 
BROKER_USERLOGGEDOUT User YRMC_MAIN\jerogers has logged out VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 2012-06-12 23:20:16.777 2012-06-12 23:20:16.823  0 
BROKER_USERLOGGEDOUT User YRMC_MAIN\jerogers has logged out VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 2012-06-12 23:20:17.120 2012-06-15 13:03:31.807  62

第2条记录是正确的。最后几个不是，它是在选择登出的记录，我不清楚如何解决这个问题。这里是数据：

EventType ModuleAndEventText Time Node UserSID 
BROKER_USERLOGGEDIN  User YRMC_MAIN\jerogers has logged in 2012-04-14 08:00:36.137 VMVIEWTC1.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 
BROKER_USERLOGGEDOUT User YRMC_MAIN\jerogers has logged out 2012-04-14 09:32:08.267 VMVIEWTC1.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 
BROKER_USERLOGGEDIN  User YRMC_MAIN\jerogers has logged in 2012-04-14 08:00:36.137 VMVIEWTC1.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 
BROKER_USERLOGGEDOUT User YRMC_MAIN\jerogers has logged out 2012-04-14 09:32:08.267 VMVIEWTC1.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 
BROKER_USERLOGGEDIN  User YRMC_MAIN\jerogers has logged in 2012-06-11 14:50:40.420 VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 
BROKER_USERLOGGEDIN  User YRMC_MAIN\jerogers has logged in 2012-06-11 16:43:08.640 VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 
BROKER_USERLOGGEDIN  User YRMC_MAIN\jerogers has logged in 2012-06-11 17:49:46.330 VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 
BROKER_USERLOGGEDIN  User YRMC_MAIN\jerogers has logged in 2012-06-11 18:42:50.047 VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 
BROKER_USERLOGGEDOUT User YRMC_MAIN\jerogers has logged out 2012-06-11 18:59:40.550 VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 
BROKER_USERLOGGEDOUT User YRMC_MAIN\jerogers has logged out 2012-06-12 23:20:16.027 VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 
BROKER_USERLOGGEDOUT User YRMC_MAIN\jerogers has logged out 2012-06-12 23:20:16.777 VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 
BROKER_USERLOGGEDOUT User YRMC_MAIN\jerogers has logged out 2012-06-12 23:20:16.823 VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 
BROKER_USERLOGGEDOUT User YRMC_MAIN\jerogers has logged out 2012-06-12 23:20:17.120 VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 
BROKER_USERLOGGEDIN  User YRMC_MAIN\jerogers has logged in 2012-06-15 13:03:31.807 VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026

在此先感谢。 Kameron

来源

2012-07-05 Kamster

这数据看起来有点奇。所以你的用户可以登录多次？那么哪个注销行应该每个登录连接到？如果单个注销应该注销每个以前的登录，那么我认为你的连接看起来像'AND t1.EventType <> t2.EventType AND t2.RN> t1.RN' – 2012-07-05 16:15:53

问题是日志文件不能整齐地交织登录和注销。

这是一种替代方法。它选择最小的退出时间在每次登录后：

select ins.UserSID, ins.time as login_time, min(outs.time) as logout_time 
from (SELECT * 
     FROM viewevent 
     where EventType in ('BROKER_USERLOGGEDOUT') 
    ) outs left outer join 
    (SELECT * 
     FROM viewevent 
     where EventType in ('BROKER_USERLOGGEDIN') 
    ) ins 
    on outs.UserSID = ins.UserSID and 
     outs.Time >= ins.Time 
group by ins.UserSID

我已经离开了用户ID（你应该添加到两个子查询或放置到与条款）的限制，并且的具体计算小时之差（因为我会使用float而不是int）。

来源

2012-07-05 16:18:02

谢谢Gordon，我会给这个一枪。 – Kamster 2012-07-05 16:42:31

你能不能添加限制你的T1 WHERE

WITH OrderedTable AS 
(
SELECT EventType 
    , ModuleAndEventText 
    , Time 
    , Node 
    , UserSID 
    , ROW_Number() OVER (Partition BY UserSID ORDER BY UserSID,EventID,Time) RN 
FROM viewevent 
where EventType in ('BROKER_USERLOGGEDIN','BROKER_USERLOGGEDOUT') and usersid = 'S-1-5-21-  999033763-294680432-740312968-10026' 
) 

SELECT t1.EventType 
    , t1.ModuleAndEventText 
    , t1.Node 
    , t1.UserSID 
    , t1.Time as TimeIn 
    , t2.Time as TimeOut 
    , DATEDIFF(hour, t1.Time, t2.Time) TimeElapsedInHours 
FROM OrderedTable2 t1 
JOIN OrderedTable2 t2 ON t1.UserSID = t2.UserSID AND t2.RN = t1.RN + 1 
WHERE t1.RN % 2 <> 0 AND t1.EventType = 'BROKER_USERLOGGEDIN' --ONLY CHANGE IS HERE - THIS RETURNS WHAT MY UNDERSTANDING OF WHAT YOU EXPECT IS 

EventType ModuleAndEventText Node UserSID TimeIn TimeOut TimeElapsedInHours 
-------------------------------------------------------------------------------------- 
BROKER_USERLOGGEDIN User YRMC_MAIN\jerogers has logged in VMVIEWTC1.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 2012-04-14 08:00:36.137 2012-04-14 09:32:08.267 1 
BROKER_USERLOGGEDIN User YRMC_MAIN\jerogers has logged in VMVIEWTC1.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 2012-04-14 08:00:36.137 2012-04-14 09:32:08.267 1 
BROKER_USERLOGGEDIN User YRMC_MAIN\jerogers has logged in VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 2012-06-11 14:50:40.420 2012-06-11 16:43:08.640 2 
BROKER_USERLOGGEDIN User YRMC_MAIN\jerogers has logged in VMVIEWWC2.yrmc.org S-1-5-21-999033763-294680432-740312968-10026 2012-06-11 17:49:46.330 2012-06-11 18:42:50.047 1 
ORDER BY t1.UserSID

来源

2012-07-05 16:32:26 user1166147

也谢谢你这个例子。这一个接近，但它将下一个记录记录为超时，即使下一个记录是UserLoggedIn事件类型。 – Kamster 2012-07-05 16:43:42

超时事件不是作为问题中的信息呈现的，似乎与OP分离，但很高兴您找到解决方案。 – user1166147 2012-07-05 16:58:28

假设有没有连接没有断开，我喜欢下面的方法生产假的sessionId

declare @tEvent table (
    UserId int, 
    EventType varchar(10), 
    EventDate datetime2 
) 

insert into @tEvent (UserId, EventType, EventDate) values 
(1, 'CONNECT', '20120101'), 
(2, 'CONNECT', '20120101'), 
(1, 'DISCONNECT', '20120102'), 
(1, 'CONNECT', '20120103'), 
(2, 'DISCONNECT', '20120103'), 
(1, 'DISCONNECT', '20120105'), 
(1, 'CONNECT', '20120106') 

select 
    conn.UserId, conn.SessionId, conn.EventDate as startDate, disco.EventDate as endDate, DATEDIFF(d, conn.EventDate, disco.EventDate) as duration 
from 
    (select 
     ROW_NUMBER() over (partition by UserId order by EventDate) SessionId, 
     UserId, 
     EventDate 
    from 
     @tEvent 
    where EventType = 'CONNECT') conn 
    left join (
    select 
     ROW_NUMBER() over (partition by UserId order by EventDate) SessionId, 
     UserId, 
     EventDate 
    from 
     @tEvent 
    where EventType = 'DISCONNECT') disco on conn.UserId = disco.UserId and conn.SessionId = disco.SessionId

来源

2012-07-05 16:40:41 tschmit007

谢谢大家的帮助。我发现了一个解决方案，我试图从更多的数据中挖掘出来，并认为我会与你分享。答案您的问题按钮不起作用的唯一问题。我会稍后再试。 – Kamster 2012-07-05 16:51:13

TSQL OrderedTable

回答

相关问题