我怎样才能得到最近的不同事件？

Question

这里是mytable样子：

+-----------------+-----------+-------------+------------------+ 
|  Time  | EventType | MachineName | UserDisplayName | 
+-----------------+-----------+-------------+------------------+ 
| 7/22/2014 6:52 | CONNECTED | MACH-10  | alice.brown  | 
| 7/22/2014 6:52 | PENDING | MACH-10  | alice.brown  | 
| 7/22/2014 9:09 | PENDING | MACH-2  | mike.hensworth | 
| 7/22/2014 6:58 | CONNECTED | MACH-2  | mike.hensworth | 
| 7/22/2014 6:57 | PENDING | MACH-2  | mike.hensworth | 
| 7/22/2014 7:00 | CONNECTED | MACH-3  | will.garden  | 
| 7/22/2014 6:59 | PENDING | MACH-3  | will.garden  | 
| 7/22/2014 5:30 | PENDING | MACH-3  | will.garden  | 
| 7/22/2014 11:20 | CONNECTED | MACH-4  | kent.clark.admin | 
| 7/22/2014 11:20 | PENDING | MACH-4  | kent.clark.admin | 
| 7/22/2014 9:28 | CONNECTED | MACH-5  | inigo.montoya | 
| 7/22/2014 9:28 | PENDING | MACH-5  | inigo.montoya | 
| 7/22/2014 9:15 | PENDING | MACH-123 | inigo.montoya | 
| 7/22/2014 12:37 | CONNECTED | P-002  | joseph.smith  | 
| 7/22/2014 12:36 | PENDING | P-002  | joseph.smith  | 
| 7/22/2014 9:43 | CONNECTED | P-005  | penny.pennyworth | 
| 7/22/2014 9:41 | PENDING | P-005  | penny.pennyworth | 
| 7/22/2014 5:41 | CONNECTED | P-006  | thor.zeus  | 
| 7/22/2014 5:40 | PENDING | P-006  | thor.zeus  | 
+-----------------+-----------+-------------+------------------+ 

的情况是人（UserDisplayName）是登录到机器（MachineNames）。 Eventtype PENDING是登录的开始，EventType CONNECTED是成功的连接。

本质上，我需要用户登录到计算机所需的平均时间。我没有很好的方法将PENDING状态连接到CONNECTED状态，因此我试图计算给定MachineName的CONNECTED状态和最近的PENDING EventType之间的时间差。

我不知道该怎么做，这就是这个问题。

但我也有问题，我想克服和识别。

1. （例如，inigo.montoya）有时用户启动一个PENDING在一个机器，那么放弃当花费长，和第二机器上启动第二PENDING。没有CONNECTED列出来关闭第一个PENDING事件。我想识别这些事件。

2. （例如，MACH-3）有时PENDING从来没有在机器上变得CONNECTED，并以某种方式的用户能够启动第二PENDING如预期其中工程。我想识别这些事件。

Answer 1

我想这应该做你想要什么：

with successes as 
(select x.userdisplayname, 
     x.machinename, 
     x.time as connection_time, 
     y.time as pending_time, 
     datediff(mi, y.time, x.time) as mins_between 
    from mytable x 
    join mytable y 
     on x.userdisplayname = y.userdisplayname 
    and x.machinename = y.machinename 
    where x.eventtype = 'CONNECTED' 
    and y.eventtype = 'PENDING' 
    and y.time = (select max(z.time) 
        from mytable z 
        where z.userdisplayname = y.userdisplayname 
         and z.machinename = y.machinename 
         and z.time < y.time)) 
select y.userdisplayname, y.machinename, null, y.time, null 
    from mytable y 
    left join successes s 
    on y.userdisplayname = s.userdisplayname 
    and s.machinename = y.machinename 
    and y.time = s.pending_time 
where s.connection_time is null 
    and y.eventtype = 'PENDING' 
union all 
select * from successes 

注意，具有空值的行表示连接尝试失败。