sql - How to return a query summing similar appearance? -


i want query group identical column , have column in output total number of each unique output below?

sig_id  ip_src       ip_dst         sig_name                                        timestamp 504    192.168.0.1  192.168.0.103   community web-php deluxebb forums.php access    2010-08-23 21:47:56 504    192.168.0.1  192.168.0.103   community web-php deluxebb forums.php access    2010-08-23 21:47:56 504    192.168.0.1  192.168.0.103   community web-php deluxebb forums.php access    2010-08-23 21:47:56 504    192.168.0.1  192.168.0.103   community web-php deluxebb forums.php access    2010-08-23 21:47:56   503    192.168.1.3  63.243.90.10    icmp destination unreachable communication destination host administratively prohibited 2010-08-23 21:51:47 503    192.168.1.3  63.243.90.10    icmp destination unreachable communication destination host administratively prohibited 2010-08-23 21:51:47 503    192.168.1.3  63.243.90.10    icmp destination unreachable communication destination host administratively prohibited 2010-08-23 21:51:47 503    192.168.1.3  63.243.90.10    icmp destination unreachable communication destination host administratively prohibited 2010-08-23 21:51:47 

i want output this:

  sig_id  ip_src       ip_dst         sig_name                                        timestamp          num   504     192.168.0.1  192.168.0.103  community web-php deluxebb forums.php access  2010-08-23 21:47:56   4  sig_id  ip_src       ip_dst         sig_name                                        timestamp                                                             num 503    192.168.1.3  63.243.90.10    icmp destination unreachable communication destination host administratively prohibited 2010-08-23 21:51:47    4  

here query have tried it's wrong:

select      signature.sig_id, inet_ntoa(ip_src), inet_ntoa(ip_dst),      signature.sig_name, event.timestamp, count(*) num      signature join      event on signature.sig_id = event.signature join      iphdr on event.sid = iphdr.sid group      signature; 

returns

sig_id  ip_src       ip_dst         sig_name                                        timestamp                                                             num     501 192.168.0.1 192.168.0.103   dns spoof query response ttl of 1 min. , no authority    2010-08-23 21:43:37                                   5236     502 192.168.0.1 192.168.0.103   community web-php deluxebb newpost.php access   2010-08-23 21:45:39                                                   238     503 192.168.0.1 192.168.0.103   icmp destination unreachable communication destination host administratively prohibited 2010-08-23 21:47:12 1428     504 192.168.0.1 192.168.0.103   community web-php deluxebb forums.php access    2010-08-23 21:47:56                                                   119     505 192.168.0.1 192.168.0.103   ms-sql version overflow attempt 2003-09-05 06:14:33                                                                   2261     506 192.168.0.1 192.168.0.103   netbios smb repeated logon failure  2003-09-06 14:11:57                                                               4879 

try this...

select signature.sig_id, inet_ntoa(ip_src), inet_ntoa(ip_dst),  signature.sig_name, event.timestamp, count(*) num     signature join     event on signature.sig_id = event.signature join      iphdr on event.sid = iphdr.sid group signature.sig_id, inet_ntoa, inet_ntoa,     signature.sig_name, event.timestamp  

in general when performing aggregate function 'count', there needs group of other columns in select list.


Comments

Popular posts from this blog

sublimetext3 - what keyboard shortcut is to comment/uncomment for this script tag in sublime -

java - No use of nillable="0" in SOAP Webservice -

ubuntu - Laravel 5.2 quickstart guide gives Not Found Error -