Jan Danielsson writes:
> I have managed to put this together:
>
> select from_ip, count(from_ip) as entries, max(ts)::timestamp(0) as
> last_access from log where to_port=22 and direction='in' group by from_ip
>
> So the only thing I'm missing is the total number of log entries, but
> that's where I'm stuck. My instinct is to try to use subqueries:
>
> select from_ip, count(from_ip) as entries, count(select * from log where
> ...) as tot_entries, max(ts)::timestamp(0) as last_access from log where
> to_port=22 and direction='in' group by from_ip
>
> ..but how do I match the from_ip in the inner select with the outer one?
I guess that is the point when you're supposed to give table an alias:
| select from_ip, count(from_ip) as entries, (select count(*) from log where
from_ip = outerlog.from_ip
| ) as tot_entries, max(ts)::timestamp(0) as last_access from log
as outerlog
| where to_port=22 and direction='in' group by from_ip
Also note the moved aggregate in the subquery.
regards,
Andreas
--