I'm querying a database (SQL) to find systems sending requests to see which are various different versions of windows (and other OSs). I check for a few known flavours and then try to get a catch-all but the catch-all catches fewer than the individual terms and I can't work out why.
e.g. for this PHP/SQL:
$monthSelect = "SELECT DISTINCT(host) FROM $table WHERE date > ('$lastMonth') ";
$v61 = $db->query($monthSelect."AND sys LIKE '%win32_v6.1%'")->num_rows;
echo "v61: $v61<br>
";
$v62 = $db->query($monthSelect."AND sys LIKE '%win32_v6.2%'")->num_rows;
echo "v62: $v62<br>
";
$nWin = $db->query($monthSelect."AND sys LIKE '%win32_v%'")->num_rows;
echo "nWin: $nWin<br>
";
I get the following output:
v61: 1907
v62: 2181
nWin: 4036
Where 4036 is obviously less than 2181+1907. But shouldn't $nWin be providing a superset of the $v62, $v61 and any other versions that are being found?
I'm at a loss as to how I could be getting these answers
You're doing a SELECT DISTINCT.
If there are duplicate hosts in both of the first 2 queries, they will only be counted once in the third query. So the total of the third query would be less than the sum of the first two.