也許我正在使這個問題變得更加複雜，希望有人能指點我的方向。我得到非常接近這個這個查詢：SQL Server查詢每日事件數＃
SELECT
Action, TimeOccurred,
COUNT(Action)
FROM
[].[dbo].[]
WHERE
Action LIKE '%Logon Failed%'
AND (DATEDIFF(day, TimeOccurred, GETDATE()) BETWEEN 0 AND 30)
GROUP BY
Action, TimeOccurred
ORDER BY
TimeOccurred
我的問題是TimeOccurred的格式如下：2017-05-13 00:02:00所以現在不是給我所有的「登錄失敗」每天的活動，我得到它每小時/分鐘/第二。
我想從本質上削減hh：mm：ss，所以我的結果是每天。希望這是有道理的。
您可以從convert()到date截斷datetime數據類型的時間部分。
select
Action
, TimeOccurred = convert(date,TimeOccurred)
, Count(Action)
from [].[dbo].[]
where Action like '%Logon Failed%'
and TimeOccured >= dateadd(day,-30,dateadd(day, datediff(day, 0, getdate()), 0))
group by Action
, convert(date,TimeOccurred)
order by TimeOccurred
爲了您where，你可以計算出日起30日內前，而不是得到一個datediff()並限制該範圍在0-30。
對於有條件的聚合，你可以做這樣的事情：
select
TimeOccurred = convert(date, TimeOccurred)
, logon_kerberos = count (case when Action like ' %logon (kerberos)%' then 1 end)
, logon_local_wts = count (case when Action like ' %logon (local/wts)%' then 1 end)
, logon_ntlm = count (case when Action like ' %logon (ntlm)%' then 1 end)
, logon_total = count (case when Action like ' %logon (%' then 1 end)
, Count(Action)
from [CPTRAX_for_Windows].[dbo].[Logon_Logoff_and_Failed_Logon_Profiles]
where Action like '%Logon (%'
and TimeOccurred >= dateadd(day, -30, dateadd(day, datediff(day, 0, getdate()), 0))
group by convert(date, TimeOccurred)
order by TimeOccurred
您可以使用日曆或日期表，這樣的事情。
對於內存只有152KB，可以有30個年份的日期的表中的這個：
/* dates table */
declare @fromdate date = '20000101';
declare @years int = 30;
/* 30 years, 19 used data pages ~152kb in memory, ~264kb on disk */
;with n as (select n from (values(0),(1),(2),(3),(4),(5),(6),(7),(8),(9)) t(n))
select top (datediff(day, @fromdate,dateadd(year,@years,@fromdate)))
[Date]=convert(date,dateadd(day,row_number() over(order by (select 1))-1,@fromdate))
into dbo.Dates
from n as deka cross join n as hecto cross join n as kilo
cross join n as tenK cross join n as hundredK
order by [Date];
create unique clustered index ix_dbo_Dates_date
on dbo.Dates([Date]);
如果不考慮創建一個表的實際步驟中，您可以只用這一個common table expression內使用：
declare @fromdate date = dateadd(day , datediff(day , 0, getdate())-30 , 0);
declare @thrudate date = dateadd(day , datediff(day , 0, getdate()), 0);
;with n as (select n from (values(0),(1),(2),(3),(4),(5),(6),(7),(8),(9)) t(n))
, dates as (
select top (datediff(day, @fromdate, @thrudate)+1)
[Date]=convert(date,dateadd(day,row_number() over(order by (select 1))-1,@fromdate))
from n as deka cross join n as hecto cross join n as kilo
cross join n as tenK cross join n as hundredK
order by [Date]
)
select [Date]
from dates;
二者必選其一，像這樣：
select
TimeOccurred = d.Date
, logon_kerberos = count (case when Action like ' %logon (kerberos)%' then 1 end)
, logon_local_wts = count (case when Action like ' %logon (local/wts)%' then 1 end)
, logon_ntlm = count (case when Action like ' %logon (ntlm)%' then 1 end)
, logon_total = count (case when Action like ' %logon (%' then 1 end)
, Count(Action)
from Dates d
left join [CPTRAX_for_Windows].[dbo].[Logon_Logoff_and_Failed_Logon_Profiles] l
on d.Date = convert(date,l.TimeOccured)
and l.Action like '%Logon (%'
where d.Date >= dateadd(day, -30, dateadd(day, datediff(day, 0, getdate()), 0))
group by d.Date
order by d.Date
數量和日曆表參考：
非常感謝你的快速簡單的回答。如果我有多個操作（例如％logon（kerberos）％或％logon（local/wts）％或％logon（ntlm）％），我想將它們的計數合併到一行中，那會是什麼樣子？ –
試過這個：從[CPTRAX_for_Windows]。[dbo]。[Logon_Logoff_and_Failed_Logon_Profiles]中選擇TimeOccurred = convert（date，TimeOccurred），Count（Action），其中Action'％Logon（％'和TimeOccurred> = dateadd（day，-30， dateadd（day，datediff（day，0，getdate（）），0））按TimeOccurred分組，按TimeOccurred轉換（date，TimeOccurred）order –
@B。佈雷肯裏奇添加了另一個選項，我的答案爲您的額外問題 – SqlZim
https://stackoverflow.com/questions/113045/how -to-返回的最新部分，上ly-from-a-sql-server-datetime-datatype – fqhv