我怎樣才能得到最近的不同事件？

Question

這裏是mytable樣子：

+-----------------+-----------+-------------+------------------+ 
|  Time  | EventType | MachineName | UserDisplayName | 
+-----------------+-----------+-------------+------------------+ 
| 7/22/2014 6:52 | CONNECTED | MACH-10  | alice.brown  | 
| 7/22/2014 6:52 | PENDING | MACH-10  | alice.brown  | 
| 7/22/2014 9:09 | PENDING | MACH-2  | mike.hensworth | 
| 7/22/2014 6:58 | CONNECTED | MACH-2  | mike.hensworth | 
| 7/22/2014 6:57 | PENDING | MACH-2  | mike.hensworth | 
| 7/22/2014 7:00 | CONNECTED | MACH-3  | will.garden  | 
| 7/22/2014 6:59 | PENDING | MACH-3  | will.garden  | 
| 7/22/2014 5:30 | PENDING | MACH-3  | will.garden  | 
| 7/22/2014 11:20 | CONNECTED | MACH-4  | kent.clark.admin | 
| 7/22/2014 11:20 | PENDING | MACH-4  | kent.clark.admin | 
| 7/22/2014 9:28 | CONNECTED | MACH-5  | inigo.montoya | 
| 7/22/2014 9:28 | PENDING | MACH-5  | inigo.montoya | 
| 7/22/2014 9:15 | PENDING | MACH-123 | inigo.montoya | 
| 7/22/2014 12:37 | CONNECTED | P-002  | joseph.smith  | 
| 7/22/2014 12:36 | PENDING | P-002  | joseph.smith  | 
| 7/22/2014 9:43 | CONNECTED | P-005  | penny.pennyworth | 
| 7/22/2014 9:41 | PENDING | P-005  | penny.pennyworth | 
| 7/22/2014 5:41 | CONNECTED | P-006  | thor.zeus  | 
| 7/22/2014 5:40 | PENDING | P-006  | thor.zeus  | 
+-----------------+-----------+-------------+------------------+ 

的情況是人（UserDisplayName）是登錄到機器（MachineNames）。 Eventtype PENDING是登錄的開始，EventType CONNECTED是成功的連接。

本質上，我需要用戶登錄到計算機所需的平均時間。我沒有很好的方法將PENDING狀態連接到CONNECTED狀態，因此我試圖計算給定MachineName的CONNECTED狀態和最近的PENDING EventType之間的時間差。

我不知道該怎麼做，這就是這個問題。

但我也有問題，我想克服和識別。

1. （例如，inigo.montoya）有時用戶啓動一個PENDING在一個機器，那麼放棄當花費長，和第二機器上啓動第二PENDING。沒有CONNECTED列出來關閉第一個PENDING事件。我想識別這些事件。

2. （例如，MACH-3）有時PENDING從來沒有在機器上變得CONNECTED，並以某種方式的用戶能夠啓動第二PENDING如預期其中工程。我想識別這些事件。

Answer 1

我想這應該做你想要什麼：

with successes as 
(select x.userdisplayname, 
     x.machinename, 
     x.time as connection_time, 
     y.time as pending_time, 
     datediff(mi, y.time, x.time) as mins_between 
    from mytable x 
    join mytable y 
     on x.userdisplayname = y.userdisplayname 
    and x.machinename = y.machinename 
    where x.eventtype = 'CONNECTED' 
    and y.eventtype = 'PENDING' 
    and y.time = (select max(z.time) 
        from mytable z 
        where z.userdisplayname = y.userdisplayname 
         and z.machinename = y.machinename 
         and z.time < y.time)) 
select y.userdisplayname, y.machinename, null, y.time, null 
    from mytable y 
    left join successes s 
    on y.userdisplayname = s.userdisplayname 
    and s.machinename = y.machinename 
    and y.time = s.pending_time 
where s.connection_time is null 
    and y.eventtype = 'PENDING' 
union all 
select * from successes 

注意，具有空值的行表示連接嘗試失敗。