Sql 什么?什么是ApplicationHash的数据类型和大小?ApplicationHash为nVarChar(40)无空。我正在从视图表中查询。看起来没有唯一的id,有一列名为“UniqueID”,但我在这个字段中发现了一些重复项。但是,所有字段的重复数据
Sql 什么?什么是ApplicationHash的数据类型和大小?ApplicationHash为nVarChar(40)无空。我正在从视图表中查询。看起来没有唯一的id,有一列名为“UniqueID”,但我在这个字段中发现了一些重复项。但是,所有字段的重复数据,sql,sql-server,sql-server-2008,Sql,Sql Server,Sql Server 2008,什么?什么是ApplicationHash的数据类型和大小?ApplicationHash为nVarChar(40)无空。我正在从视图表中查询。看起来没有唯一的id,有一列名为“UniqueID”,但我在这个字段中发现了一些重复项。但是,所有字段的重复数据似乎完全相同。是否可以添加以下内容?在表dbo.AllApps中有一个名为UserName的列。就像通过获取ApplicationHash中唯一值的重复次数来计算ProcessCount一样,我们可以计算唯一ApplicationHash值的唯
什么?什么是
ApplicationHash
的数据类型和大小?ApplicationHash为nVarChar(40)无空。我正在从视图表中查询。看起来没有唯一的id,有一列名为“UniqueID”,但我在这个字段中发现了一些重复项。但是,所有字段的重复数据似乎完全相同。是否可以添加以下内容?在表dbo.AllApps中有一个名为UserName的列。就像通过获取ApplicationHash中唯一值的重复次数来计算ProcessCount一样,我们可以计算唯一ApplicationHash值的唯一用户名总数吗?示例应用程序哈希ABCDE12345重复10次(因此这是进程计数),但在这10次中,其中5次记录User123,另5次记录User456,从而使用户名计数为2。
`/* !!!!!DEFINE START AND END DATE FOR REPORT HERE!!!!!*/
DECLARE @StartDate DATETIME = 2017-01-01
DECLARE @EndDate DATETIME = 2017-01-02`
`/* Checks if the temp table #PCount exist and deletes the table if it does */
IF OBJECT_ID('tempdb..#PCount') IS NOT NULL
BEGIN
DROP TABLE #PCount
END`
`/* Performs a COUNT on the ApplicationHash entries */
SELECT ApplicationHash, COUNT(ApplicationHash) AS ProcessCount
INTO #PCount
FROM dbo.AllApps
WHERE
TokenType = 'Elevated'
AND ApplicationType != 'COM Class'
AND ApplicationType != 'ActiveX Control'
AND ProcessStartTime >= @StartDate
AND ProcessStartTime < @EndDAte
GROUP BY ApplicationHash`
`/* Pulls up the actual report and inserts the count value for the ApplicationHash */
SELECT #PCount.ProcessCount,
dbo.AllApps.ApplicationHash,
dbo.AllApps.ProcessStartTime,
dbo.AllApps.ApplicationType,
dbo.AllApps.Description,
dbo.AllApps.Publisher,
dbo.AllApps.ProductName,
dbo.AllApps.ProductVersion,
dbo.AllApps.EventDescription,
dbo.AllApps.CommandLine,
dbo.AllApps.FileName
FROM #PCount, dbo.AllApps
WHERE dbo.AllApps.ApplicationHash = #PCount.ApplicationHash
AND TokenType = 'Elevated'
AND ApplicationType != 'COM Class'
AND ApplicationType != 'ActiveX Control'
AND ProcessStartTime >= @StartDate
AND ProcessStartTime < @EndDate
ORDER BY ProcessStartTime DESC`
;with cte as
(
SELECT ROW_NUMBER() OVER(PARTITION BY ApplicationHash ORDER BY ProcessStartTime) as rn,
#PCount.ProcessCount,
dbo.AllApps.ApplicationHash,
dbo.AllApps.ProcessStartTime,
dbo.AllApps.ApplicationType,
dbo.AllApps.Description,
dbo.AllApps.Publisher,
dbo.AllApps.ProductName,
dbo.AllApps.ProductVersion,
dbo.AllApps.EventDescription,
dbo.AllApps.CommandLine,
dbo.AllApps.FileName
FROM #PCount
INNER JOIN dbo.AllApps ON dbo.AllApps.ApplicationHash = #PCount.ApplicationHash
WHERE TokenType = 'Elevated'
AND ApplicationType != 'COM Class'
AND ApplicationType != 'ActiveX Control'
AND ProcessStartTime >= @StartDate
AND ProcessStartTime < @EndDate
)
SELECT ProcessCount,
ApplicationHash,
ProcessStartTime,
ApplicationType,
Description,
Publisher,
ProductName,
ProductVersion,
EventDescription,
CommandLine,
FileName
FROM CTE
WHERE rn = 1
declare @StartDate datetime = '20170101';
declare @EndDate datetime = '20170102';
select top 1 with ties
ProcessCount = count(*) over (
partition by ApplicationHash
, case
when ApplicationHash = '<None>'
then ProcessStartTime
else @StartDate
end
order by ProcessStartTime desc
)
, ApplicationHash
, ProcessStartTime
, ApplicationType
, Description
, Publisher
, ProductName
, ProductVersion
, EventDescription
, CommandLine
, FileName
from dbo.AllApps aa
where TokenType = 'Elevated'
and ApplicationType != 'com Class'
and ApplicationType != 'ActiveX Control'
and ProcessStartTime >= @StartDate
and ProcessStartTime < @EndDate
order by row_number() over (
partition by ApplicationHash
, case
when ApplicationHash = '<None>'
then ProcessStartTime
else @StartDate
end
order by ProcessStartTime desc
)