Sql 什么?什么是ApplicationHash的数据类型和大小?ApplicationHash为nVarChar(40)无空。我正在从视图表中查询。看起来没有唯一的id,有一列名为“UniqueID”,但我在这个字段中发现了一些重复项。但是,所有字段的重复数据

Sql 什么?什么是ApplicationHash的数据类型和大小?ApplicationHash为nVarChar(40)无空。我正在从视图表中查询。看起来没有唯一的id,有一列名为“UniqueID”,但我在这个字段中发现了一些重复项。但是,所有字段的重复数据,sql,sql-server,sql-server-2008,Sql,Sql Server,Sql Server 2008,什么?什么是ApplicationHash的数据类型和大小?ApplicationHash为nVarChar(40)无空。我正在从视图表中查询。看起来没有唯一的id,有一列名为“UniqueID”,但我在这个字段中发现了一些重复项。但是,所有字段的重复数据似乎完全相同。是否可以添加以下内容?在表dbo.AllApps中有一个名为UserName的列。就像通过获取ApplicationHash中唯一值的重复次数来计算ProcessCount一样,我们可以计算唯一ApplicationHash值的唯


什么?什么是
ApplicationHash
的数据类型和大小?ApplicationHash为nVarChar(40)无空。我正在从视图表中查询。看起来没有唯一的id,有一列名为“UniqueID”,但我在这个字段中发现了一些重复项。但是,所有字段的重复数据似乎完全相同。是否可以添加以下内容?在表dbo.AllApps中有一个名为UserName的列。就像通过获取ApplicationHash中唯一值的重复次数来计算ProcessCount一样,我们可以计算唯一ApplicationHash值的唯一用户名总数吗?示例应用程序哈希ABCDE12345重复10次(因此这是进程计数),但在这10次中,其中5次记录User123,另5次记录User456,从而使用户名计数为2。
`/* !!!!!DEFINE START AND END DATE FOR REPORT HERE!!!!!*/
DECLARE @StartDate DATETIME = 2017-01-01
DECLARE @EndDate DATETIME = 2017-01-02`

`/* Checks if the temp table #PCount exist and deletes the table if it does */
IF OBJECT_ID('tempdb..#PCount') IS NOT NULL
BEGIN
DROP TABLE #PCount
END`

`/* Performs a COUNT on the ApplicationHash entries */
SELECT ApplicationHash, COUNT(ApplicationHash) AS ProcessCount
INTO #PCount
FROM dbo.AllApps 
WHERE
TokenType = 'Elevated' 
AND ApplicationType != 'COM Class'
AND ApplicationType != 'ActiveX Control'
AND ProcessStartTime >= @StartDate
AND ProcessStartTime < @EndDAte
GROUP BY ApplicationHash`

`/* Pulls up the actual report and inserts the count value for the ApplicationHash */
SELECT #PCount.ProcessCount, 
dbo.AllApps.ApplicationHash, 
dbo.AllApps.ProcessStartTime,
dbo.AllApps.ApplicationType,
dbo.AllApps.Description, 
dbo.AllApps.Publisher, 
dbo.AllApps.ProductName, 
dbo.AllApps.ProductVersion, 
dbo.AllApps.EventDescription, 
dbo.AllApps.CommandLine, 
dbo.AllApps.FileName
FROM #PCount, dbo.AllApps 
WHERE dbo.AllApps.ApplicationHash = #PCount.ApplicationHash
AND TokenType = 'Elevated'
AND ApplicationType != 'COM Class'
AND ApplicationType != 'ActiveX Control'
AND ProcessStartTime >= @StartDate
AND ProcessStartTime < @EndDate
ORDER BY ProcessStartTime DESC`
;with cte as
(
SELECT ROW_NUMBER() OVER(PARTITION BY ApplicationHash ORDER BY ProcessStartTime) as rn,
#PCount.ProcessCount, 
dbo.AllApps.ApplicationHash, 
dbo.AllApps.ProcessStartTime,
dbo.AllApps.ApplicationType,
dbo.AllApps.Description, 
dbo.AllApps.Publisher, 
dbo.AllApps.ProductName, 
dbo.AllApps.ProductVersion, 
dbo.AllApps.EventDescription, 
dbo.AllApps.CommandLine, 
dbo.AllApps.FileName
FROM #PCount
INNER JOIN dbo.AllApps ON dbo.AllApps.ApplicationHash = #PCount.ApplicationHash
WHERE TokenType = 'Elevated'
AND ApplicationType != 'COM Class'
AND ApplicationType != 'ActiveX Control'
AND ProcessStartTime >= @StartDate
AND ProcessStartTime < @EndDate
)

SELECT ProcessCount, 
       ApplicationHash, 
       ProcessStartTime,
       ApplicationType,
       Description, 
       Publisher, 
       ProductName, 
       ProductVersion, 
       EventDescription, 
       CommandLine, 
       FileName
FROM CTE
WHERE rn = 1
declare @StartDate datetime = '20170101';
declare @EndDate datetime   = '20170102';

select top 1 with ties
    ProcessCount = count(*) over (
      partition by ApplicationHash 
        , case 
          when ApplicationHash = '<None>' 
            then ProcessStartTime
          else @StartDate
          end 
      order by ProcessStartTime desc
      )
  , ApplicationHash
  , ProcessStartTime
  , ApplicationType
  , Description
  , Publisher
  , ProductName
  , ProductVersion
  , EventDescription
  , CommandLine
  , FileName
from dbo.AllApps aa
where TokenType = 'Elevated' 
  and ApplicationType != 'com Class'
  and ApplicationType != 'ActiveX Control'
  and ProcessStartTime >= @StartDate
  and ProcessStartTime < @EndDate
order by row_number() over (
  partition by ApplicationHash
    , case 
      when ApplicationHash = '<None>' 
        then ProcessStartTime
      else @StartDate
      end
  order by ProcessStartTime desc
  )