logparser學習筆記

數學函數：
ADD, SUB, MUL, DIV, MOD, QUANTIZE

字符串函數：
SUBSTR, STRCAT, STRLEN, EXTRACT_TOKEN
TO_UPPERCASE
REVERSEDNS(c-ip)

時間函數：
TO_DATE, TO_TIME, TO_UTCTIME
TIMESTAMP('0000-01-02', 'yyyy-MM-dd')
TO_LOCALTIME(SYSTEM_TIMESTAMP())


聚集函數：
count(*),SUM, COUNT, MAX, MIN, AVG
propcount(*)可以跟on
propsum(*)可以跟on

--求解全路徑
STRCAT( cs-uri-stem, REPLACE_IF_NOT_NULL( cs-uri-query, STRCAT( '?', cs-uri-query ) ) )


--取最近24小時的事件
SELECT * FROM System
WHERE TimeWritten >= SUB( TO_LOCALTIME(SYSTEM_TIMESTAMP()), TIMESTAMP('0000-01-02', 'yyyy-MM-dd') )

--取出所有的asp頁面
SELECT COUNT(*) FROM ex040528.log WHERE EXTRACT_EXTENSION(cs-uri-stem) LIKE 'asp'

--求出各個路徑的訪問次數
SELECT cs-uri-stem, COUNT(*) FROM ex040528.log GROUP BY cs-uri-stem

--求出各個資源類型的訪問次數
SELECT EXTRACT_EXTENSION(cs-uri-stem) AS PageType, COUNT(*)
FROM ex040528.log
GROUP BY PageType

--group by兩個東東
SELECT EXTRACT_EXTENSION(cs-uri-stem) AS PageType, sc-status, COUNT(*)
FROM ex040528.log
GROUP BY PageType, sc-status


--求出各個資源類型的訪問次數，並按訪問次數降序排列
SELECT EXTRACT_EXTENSION(cs-uri-stem) AS PageType, COUNT(*) AS PageTypeHits
FROM ex040528.log
GROUP BY PageType
ORDER BY PageTypeHits DESC


--求出各個頁面類型，各種返回結果佔總點擊數的比重
SELECT EXTRACT_EXTENSION(cs-uri-stem) AS PageType, sc-status, MUL(PROPCOUNT(*), 100.0) AS Hits
FROM ex040528.log
GROUP BY PageType, sc-status
ORDER BY PageType, sc-status


--求出各個頁面類型、各種返回結果的點擊數佔各種頁面類型點擊數的百分比
SELECT EXTRACT_EXTENSION(cs-uri-stem) AS PageType, sc-status, MUL(PROPCOUNT(*) ON (PageType), 100.0) AS Hits
FROM ex040528.log
GROUP BY PageType, sc-status
ORDER BY PageType, sc-status

--求解各種類型的客戶端環境佔總環境數的百分比
SELECT DISTINCT cs(User-Agent) as IEType,count(*) as total,mul(propcount(*),100) as [percent(%)]
FROM F:/挑戰賽資料/ex081213.log
group by IEType


轉義字符：
/

注意：
order by後只能有一個desc或者asc
order by的項必須要在select子句中
having子句必須緊跟group子句