sql - How to return a query summing similar appearance? -
i want query group identical column , have column in output total number of each unique output below?
sig_id ip_src ip_dst sig_name timestamp 504 192.168.0.1 192.168.0.103 community web-php deluxebb forums.php access 2010-08-23 21:47:56 504 192.168.0.1 192.168.0.103 community web-php deluxebb forums.php access 2010-08-23 21:47:56 504 192.168.0.1 192.168.0.103 community web-php deluxebb forums.php access 2010-08-23 21:47:56 504 192.168.0.1 192.168.0.103 community web-php deluxebb forums.php access 2010-08-23 21:47:56 503 192.168.1.3 63.243.90.10 icmp destination unreachable communication destination host administratively prohibited 2010-08-23 21:51:47 503 192.168.1.3 63.243.90.10 icmp destination unreachable communication destination host administratively prohibited 2010-08-23 21:51:47 503 192.168.1.3 63.243.90.10 icmp destination unreachable communication destination host administratively prohibited 2010-08-23 21:51:47 503 192.168.1.3 63.243.90.10 icmp destination unreachable communication destination host administratively prohibited 2010-08-23 21:51:47
i want output this:
sig_id ip_src ip_dst sig_name timestamp num 504 192.168.0.1 192.168.0.103 community web-php deluxebb forums.php access 2010-08-23 21:47:56 4 sig_id ip_src ip_dst sig_name timestamp num 503 192.168.1.3 63.243.90.10 icmp destination unreachable communication destination host administratively prohibited 2010-08-23 21:51:47 4
here query have tried it's wrong:
select signature.sig_id, inet_ntoa(ip_src), inet_ntoa(ip_dst), signature.sig_name, event.timestamp, count(*) num signature join event on signature.sig_id = event.signature join iphdr on event.sid = iphdr.sid group signature;
returns
sig_id ip_src ip_dst sig_name timestamp num 501 192.168.0.1 192.168.0.103 dns spoof query response ttl of 1 min. , no authority 2010-08-23 21:43:37 5236 502 192.168.0.1 192.168.0.103 community web-php deluxebb newpost.php access 2010-08-23 21:45:39 238 503 192.168.0.1 192.168.0.103 icmp destination unreachable communication destination host administratively prohibited 2010-08-23 21:47:12 1428 504 192.168.0.1 192.168.0.103 community web-php deluxebb forums.php access 2010-08-23 21:47:56 119 505 192.168.0.1 192.168.0.103 ms-sql version overflow attempt 2003-09-05 06:14:33 2261 506 192.168.0.1 192.168.0.103 netbios smb repeated logon failure 2003-09-06 14:11:57 4879
try this...
select signature.sig_id, inet_ntoa(ip_src), inet_ntoa(ip_dst), signature.sig_name, event.timestamp, count(*) num signature join event on signature.sig_id = event.signature join iphdr on event.sid = iphdr.sid group signature.sig_id, inet_ntoa, inet_ntoa, signature.sig_name, event.timestamp
in general when performing aggregate function 'count', there needs group of other columns in select list.
Comments
Post a Comment