I have following data in splunk in two different sourcetypes
index="xyz" sourcetype="assets"
name
--------
SERVER01
SERVER02
SERVER03
index="xyz" sourcetype="computers"
name
--------
SERVER02
SERVER03
SERVER05
i am trying to fetch data which is not matching in both sourcetypes
name
--------
SERVER01
SERVER05
i tried doing data selection using outer join as mentioned below but seems its not working
index="xyz" sourcetype="assets"
| table name
| join type=outer name
[| search index="xyz" sourcetype="computers"
| table name]
| table name
Please suggest
The stats command can do that. Collect the servers from each sourcetype and count their number. Those with a count of 1 don't match.
index=xyz (sourcetype=assets OR sourcetype=computers)
| stats count by name
| where count = 1
| table name
Related
I have a database called global and in that database I have groups table and reservations table, and the relation is one to many (one group can have many reservations).
What I wanted to do was to display the group name along with the first check in date and the last check out date of the reservations.
I am developing using codeigniter 3.x.
Assuming you have this structure of tables:
GROUPS
+--------+-----------+
| id | Name |
+--------+-----------+
and:
RESERVATIONS
+--------+-----------+------------------------------+------------------------------+
| id | Groupid | ReservationCheckinDate | ReservationCheckoutDate |
+--------+-----------+------------------------------+------------------------------+
the SQL to get the desired result would be:
SELECT MIN(ReservationCheckinDate), MAX(ReservationCheckoutDate), Name FROM RESERVATIONS
JOIN GROUPS ON GROUPS.id = RESERVATIONS.Groupid
GROUP BY Name
ORDER BY Name;
hope it helps
Using one single SQL query with a join:
How can I add entries from a second table only if there is a corresponding entry available?
project source
description | source source_id | value
---------------------------- --------------------------------
Project 1 | 1 1 | Additional Info 1
Project 2 | null
When I type
select project.description, source.value
from project, source
where project.source = source.source_id
and project.description = "Project 1";
As desired I receive
Project 1 | Additional Info 1
However when I replace Project 1 with Project 2 in the last line, I won't get a result, because project.source is null.
Is it possible to use a single SQL query which outputs something like this?
Project 2 | null
I´m looking for a query which covers both cases.
Any ideas?
You can use a LEFT JOIN on the project table to make sure that all projects appear in the result set even if they have no matching value in the source table. Projects from the project table which do not match will have NULL for their value.
SELECT project.description AS description, source.value AS value
FROM project LEFT JOIN source
ON project.source = source.source_id
Output:
+--------------+--------------------+
| description | value |
---------------+--------------------+
| Project 1 | Additional Info 1 |
| Project 2 | null |
+--------------+--------------------+
Try to use left join....
SELECT project.description, source.value FROM project LEFT JOIN source ON project.source = source.source_id;
For some reason, I am unable to export a table of subscribers from my phpList (ver. 3.0.6) admin pages. I've searched on the web, and several others have had this problem but no workarounds have been posted. As a workaround, I would like to query the mySQL database directly to retrieve a similar table of subscribers. But I need help with the SQL command. Note that I don't want to export or backup the mySQL database, I want to query it in the same way that the "export subscribers" button is supposed to do in the phpList admin pages.
In brief, I have two tables to query. The first table, user contains an ID and email for every subscriber. For example:
id | email
1 | e1#gmail.com
2 | e2#gmail.com
The second table, user_attribute contains a userid, attributeid, and value. Note in the example below that userid 1 has values for all three possible attributes, while userid's 2 and 3 are either missing one or more of the three attributeid's, or have blank values for some.
userid | attributeid | value
1 | 1 | 1
1 | 2 | 4
1 | 3 | 6
2 | 1 | 3
2 | 3 |
3 | 1 | 4
I would like to execute a SQL statement that would produce a row of output for each id/email that would look like this (using id 3 as an example):
id | email | attribute1 | attribute2 | attribute3
3 | e3#gmail.com | 4 | "" | "" |
Can someone suggest SQL query language that could accomplish this task?
A related query I would like to run is to find all id/email that do not have a value for attribute3. In the example above, this would be id's 2 and 3. Note that id 3 does not even have a blank value for attributeid3, it is simply missing.
Any help would be appreciated.
John
I know this is a very old post, but I just had to do the same thing. Here's the query I used. Note that you'll need to modify the query based on the custom attributes you have setup. You can see I had name, city and state as shown in the AS clauses below. You'll need to map those to the attribute id. Also, the state has a table of state names that I linked to. I excluded blacklisted (unsubscribed), more than 2 bounces and unconfirmed users.
SELECT
users.email,
(SELECT value
FROM `phplist_user_user_attribute` attrs
WHERE
attrs.userid = users.id and
attributeid=1
) AS name,
(SELECT value
FROM `phplist_user_user_attribute` attrs
WHERE
attrs.userid = users.id and
attributeid=3
) AS city,
(SELECT st.name
FROM `phplist_user_user_attribute` attrs
LEFT JOIN `phplist_listattr_state` st
ON attrs.value = st.id
WHERE
attrs.userid = users.id and
attributeid=4
) AS state
FROM
`phplist_user_user` users
WHERE
users.blacklisted=0 and
users.bouncecount<3 and
users.confirmed=1
;
I hope someone finds this helpful.
I have created a users table that holds names and phone numbers (users).
id| name | phone
1 | Frank | 0345221234
2 | Sara | 0342555939
I got another table that holds a log with user's calls to different numbers (call_logs):
number | destination | price
0345221234 | destination | x /// This is Frank
0345221234 | destination | y /// This is also Frank
0342555939 | destination | z /// This is Sara
And then I have a table that holds numbers that Frank and Sara are allowed to call (allowed_numbers):
number
033485733
045727728
082358288
I would like to loop through my users table and based on their number to check the calls log table and select the SUM of price column for log records where destination does not match the allowed numbers table so that I know the cost for calls not in the allowed list.
Then I want to select SUM of price column for log records where destination DO match
the allowed numbers table so that I know how much did the allowed calls cost.
Is there any way I can do this in a single query with sub-queries and all needed in order to achieve this result set:
users number | SUM(price) of allowed calls | SUM(price) of calls not allowed
Thank you!
SELECT call_logs.number
,SUM(IF(allowed_numbers.number IS NOT NULL,call_logs.price,0)) AS AllowedPrice
,SUM(IF(allowed_numbers.number IS NULL,call_logs.price,0)) AS NotAllowedPrice
FROM call_logs
LEFT JOIN allowed_numbers
ON call_logs.destination = allowed_numbers.number
GROUP BY call_logs.number;
I have 2 sql tables
Table name: agents contains a records with a coloumn AgentID
Table named: vacancies is the one with the data ans is being dislayed.
Table named vacancies has vacancies.Agents which contains values simmilar to this
VacanyID Company position CTC Candidates Agents
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FBVAC001 | HDFC | Branch Manager | 4.5 | FBCAN001,FBCAN002| Agent3,Agent4
FBVAC003 | TBNH | Branch Manager | 4.5 | FBCAN004,FBCAN005| Agent2,Agent4
FBVAC005 | MMNT | Branch Manager | 4.5 | FBCAN008,FBCAN006| Agent3
FBVAC008 | LCFC | Branch Manager | 4.5 | FBCAN009,FBCAN023| Agent3,Agent4
FBVAC008 | KOTC | Branch Manager | 4.5 | FBCAN009,FBCAN023| Agent5,Agent4
I want to run a query that will return only those records that contain the value that corresponds to agents.AgentID from table name agents. This is the query so far but all it returs are those records that do not have more than one value in vacancies.Agents
for example if the value being searched for is Agent3 it should return rows1,3 and 4 instead it only returns row 3.
SELECT
vacancies.VacancyID,
vacancies.Company,
vacancies.`Position`,
vacancies.CTC,
vacancies.Candidates,
vacancies.Agents
FROM vacancies
, agents
WHERE (FIND_IN_SET(vacancies.Agents,agents.AgentID) <> 0)
How can this be resolved?
I believe you have your parameters backwards in FIND_IN_SET. The set should come second
FIND_IN_SET(agents.AgentID, vacancies.Agents)
More Info: http://www.bitbybit.dk/carsten/blog/?p=162
Also, if you are wanting to see only a specific agent, you need to filter for that as well, otherwise you're getting every possible combination of agent and matching vacancies (hence the duplicate rows):
AND Agents.AgentID = 'Agent3'
Demo: http://www.sqlfiddle.com/#!2/b4dcb/3
SELECT
vacancies.VacancyID,
vacancies.Company,
vacancies.`Position`,
vacancies.CTC,
vacancies.Candidates,
vacancies.Agents
FROM vacancies,
agents
WHERE (select
agents.agentid,
vacancies.agentid
from agents
left join vacancies
on vacancies.agentid = agents.agentid)
and agents.agentid = 'Agent3'