CREATE TEMPORARY TABLE statistics_table_temp SELECT * FROM (SELECT now) times, (SELECT client_ip,ruleid,event_type,severity FROM audit_table WHERE `tstamp` >= DATE_SUB(now, INTERVAL 10 MINUTE) AND `tstamp` < now) AS ret_statitics_table_temp;
INSERT INTO event_times_1hour(sttime, event_type, count) SELECT * FROM (SELECT now) times, (SELECT event_type,COUNT(event_type) AS total_count from statistics_table_temp group by event_type order by total_count desc) AS ret_event_times_1hour on duplicate key update count=total_count;
其中now是传递的参数
你的数据库应该不是oracle或者sqlserver应该是mysql吧,第一条语句可以拆分一下
(SELECT client_ip,ruleid,event_type,severity FROM audit_table WHERE `tstamp` >= DATE_SUB(now, INTERVAL 10 MINUTE) AND `tstamp` < now) AS ret_statitics_table_temp;//y一个select语句查询得到表ret_statitics_table_temp
(SELECT now) times//得到表times
SELECT * FROM times,ret_statitics_table_temp//这个语句查询结果跟times left join ret_statitics_table_temp一样得到一张新的表
CREATE TEMPORARY TABLE statistics_table_temp 新的表(也就是SELECT * FROM times,ret_statitics_table_temp)//建立一个临时表statistics_table_temp,oracle是用的CREATE TEMPORARY TABLE statistics_table_temp as SELECT * FROM times,ret_statitics_table_temp)
第二个语句就是你建立一个临时表后插入数据
(SELECT event_type,COUNT(event_type) AS total_count from statistics_table_temp group by event_type order by total_count desc) AS ret_event_times_1hour on duplicate key update count=total_count;
(SELECT now) times;
SELECT * FROM times,ret_event_times_1hour;
INSERT INTO event_times_1hour(sttime, event_type, count) SELECT * FROM times,ret_event_times_1hour;