Sql 使用子查询作为引用在同一查询中生成多个结果

我正在使用sqlite来存储一些数据，我有一个子查询，我想重用它来推断多个结果，子查询如下：

select * from s_stats where datetime(start_time) > datetime('now','localtime','-3 days') group by src_ip,src_port,dest_ip,dest_port order by start_time desc 

我想重新使用上面的查询在同一个查询中生成多个过滤数据

一个结果是这样做的：

 select start_time,action,count(*) from (select * from s_stats where datetime(start_time) > datetime('now','localtime','-3 days') group by src_ip,src_port,dest_ip,dest_port order by start_time desc) where action='BLOCKED' group by action,start_time order by start_time desc

我还想做：

select start_time,action,count(*) from (select * from s_stats where datetime(start_time) > datetime('now','localtime','-3 days') group by src_ip,src_port,dest_ip,dest_port order by start_time desc) group by start_time order by start_time desc

有没有办法通过使用子查询作为变量将两个查询合并为一个查询

---

谢谢

您可以使用条件聚合在一个查询中获取两个计数：

select start_time,
       action,
       count(case when action = 'BLOCKED' then 1 end) as blocked,
       count(*) as total
from (select * 
      from s_stats 
      where datetime(start_time) > datetime('now','localtime','-3 days') 
      group by src_ip,src_port,dest_ip,dest_port 
      order by start_time desc)
group by start_time 
order by start_time desc

---

可以使用条件聚合在一个查询中获取两个计数：

select start_time,
       action,
       count(case when action = 'BLOCKED' then 1 end) as blocked,
       count(*) as total
from (select * 
      from s_stats 
      where datetime(start_time) > datetime('now','localtime','-3 days') 
      group by src_ip,src_port,dest_ip,dest_port 
      order by start_time desc)
group by start_time 
order by start_time desc

---

谢谢你的回答。从来没有人知道可以在sql函数中使用用例。将测试并确认答案：）谢谢你的回答。从来没有人知道可以在sql函数中使用用例。将测试并确认答案：）