SQL Server：将结果返回一行并附加COUNT列

Question

表dbo.AllApps记录所有已运行的可执行文件，它具有存储exe文件哈希值的列ApplicationHash，存储执行exe的用户ID的列UserName。

如果exe已经运行了10次，表中将会有10个条目具有相同的信息，但具有不同的时间戳和执行该实例的用户。

我想生成一个只返回10行（包括所有列时间，名称，desc ...）的报告，另外还有一列将提供exe的次数被执行（在这个例子中总共10行）和执行exe的唯一用户数量（在这个例子中是3）。

有什么建议吗？

ApplicationHash TimeStamp UserName 
----------------------------------- 
ABCDE12345  00:00:05 User1 
ABCDE12345  00:02:05 User2 
ABCDE12345  00:04:05 User1 
ABCDE12345  00:10:05 User3 
ABCDE12345  00:15:05 User3 
ABCDE12345  00:20:05 User1 
ABCDE12345  00:21:05 User2 
ABCDE12345  00:33:05 User2 
ABCDE12345  00:45:05 User1 
ABCDE12345  00:55:05 User1 

结果应该是somethine这样的：

ApplicationHash ProcessCount UserCount 
-------------------------------------- 
ABCDE12345   10   3 

这里是有人想出了这确实解决了ProcessCount问题，但我需要一个唯一的用户名数，以及：

declare @StartDate datetime = '20170401'; 
declare @EndDate datetime = '20170406'; 

select top 1 with ties 
    ProcessCount = count(*) over (partition by ApplicationHash) 
    , ApplicationHash 
    , ProcessStartTime 
    , ApplicationType 
    , Description 
    , Publisher 
    , ProductName 
    , ProductVersion 
    , EventDescription 
    , CommandLine 
    , FileName 
from dbo.AllApps aa 
where TokenType = 'Elevated' 
    and ApplicationType != 'com Class' 
    and ApplicationType != 'ActiveX Control' 
    and ProcessStartTime >= @StartDate 
    and ProcessStartTime < @Enddate 
    and ProductName = 'WizSvcUt Application' 
order by row_number() over (partition by ApplicationHash order by ProcessStartTime desc) 

Answer 1

您可以将count(distinct userName)添加到临时表中。我也改变了你的隐式连接到一个显式连接：

/* !!!!!DEFINE START AND END DATE FOR REPORT HERE!!!!!*/ 
DECLARE @StartDate DATETIME = 2017-01-01 
DECLARE @EndDate DATETIME = 2017-01-02 

/* Checks if the temp table #PCount exist and deletes the table if it does */ 
IF OBJECT_ID('tempdb..#PCount') IS NOT NULL 
BEGIN 
    DROP TABLE #PCount 
END 

/* Performs a COUNT on the ApplicationHash entries and distinct user names*/ 
SELECT ApplicationHash, 
     COUNT(ApplicationHash) AS ProcessCount, 
     COUNT(DISTINCT UserName) As UserCount 
INTO #PCount 
FROM dbo.AllApps 
WHERE TokenType = 'Elevated' 
    AND ApplicationType != 'COM Class' 
    AND ApplicationType != 'ActiveX Control' 
    AND ProcessStartTime >= @StartDate 
    AND ProcessStartTime < @EndDAte 
GROUP BY ApplicationHash 

/* Pulls up the actual report and inserts the count value for the ApplicationHash */ 
SELECT 
    #PCount.ProcessCount, 
    dbo.AllApps.ApplicationHash, 
    dbo.AllApps.ProcessStartTime, 
    dbo.AllApps.ApplicationType, 
    dbo.AllApps.Description, 
    dbo.AllApps.Publisher, 
    dbo.AllApps.ProductName, 
    dbo.AllApps.ProductVersion, 
    dbo.AllApps.EventDescription, 
    dbo.AllApps.CommandLine, 
    dbo.AllApps.FileName 
FROM 
    #PCount 
INNER JOIN dbo.AllApps ON dbo.AllApps.ApplicationHash = #PCount.ApplicationHash 
WHERE TokenType = 'Elevated' 
AND ApplicationType != 'COM Class' 
AND ApplicationType != 'ActiveX Control' 
AND ProcessStartTime >= @StartDate 
AND ProcessStartTime < @EndDate 
ORDER BY 
    ProcessStartTime DESC 

我不知道如果这是在2008年版本的支持，但在2012年，你可以简单地使用过子句计数，并获得同一结果在一个查询中：

SELECT 
    COUNT(*) OVER (PARTITION BY ApplicationHash) AS ProcessCount, 
    COUNT(*) OVER (PARTITION BY ApplicationHash, UserName) As UserCount 
    ApplicationHash, 
    ProcessStartTime, 
    ApplicationType, 
    Description, 
    Publisher, 
    ProductName, 
    ProductVersion, 
    EventDescription, 
    CommandLine, 
    FileName 
FROM dbo.AllApps 
WHERE TokenType = 'Elevated' 
AND ApplicationType != 'COM Class' 
AND ApplicationType != 'ActiveX Control' 
AND ProcessStartTime >= @StartDate 
AND ProcessStartTime < @EndDate 
ORDER BY 
    ProcessStartTime DESC