通过另一列SQL中的唯一条目对列进行分组

Question

I have the following dataset

I would like to query the data to produce a list of unique hostnames per username with the last login time for that record also included. Eg produce the following dataset.

The goal is to detect users account sharing, and also users with an abnormally large number of host names.

I know enough SQL to get myself into trouble but I simply do not write queries often enough to be proficient enough to write this one without blowing half a day on it. Can anyone assist?

We are using Azure SQL (SQL Server), however I can translate answers from another SQL language.

Thank you

UPDATE

I have used the following

select username, hostname, max(logintimeutc)
from loginrecords
group by username, hostname

which returns a good dataset, however when I try the following it returns 0 records despite the query above showing multiple usernames against the same hostname

select username, hostname, max(logintimeutc)
from loginrecords
group by username, hostname
having count(distinct(hostname)) > 1

Answer 1

I would like to query the data to produce a list of unique hostnames per username with the last login time for that record also included.

I think you just want group by :

select username, hostname, max(logintimeutc)
from t
group by username, hostname;

Answer 2

you can use row_number() for this.

select * from table1 t1
inner join
    (select row_number() over (partition by HostName, UserName order by LoginTimeUTC desc) as rn, UserName
            ,LoginTimeUTC, HostName from table1) as t2
on t2.UserName = t1.UserName and t2.LoginTimeUTC = t2.LoginTimeUTC and t2.HostName = t1.HostName
where t2.rn = 1

Answer 3

If I understand right, 2 results are expected without considering the login time, pls have a try below query:

select username,hostname,
count(*) over (partition by hostname) as NUMBER_OF_USERS_FOR_THIS_HOST,
count(*) over (partition by username) as NUMBER_OF_HOSTS_FOR_THIS_USER
from loginrecords
group by username, hostname;

Answer 4

First I created a test environment using the queries below. It would be nice if you provide these (or textual tabular data) yourself in future questions. Screenshots with data are very unfriendly for testing purposes.

CREATE TABLE [LoginRecords] (
    [LoginTimeUTC] SMALLDATETIME,
    [UserName] VARCHAR(5),
    [HostName] VARCHAR(5)
);
GO

INSERT INTO [LoginRecords] VALUES
    ('2019-08-22T09:51:00', 'user1', 'host1'),
    ('2019-08-25T09:31:00', 'user1', 'host2'),
    ('2019-08-30T10:51:00', 'user1', 'host2'),
    ('2019-08-25T09:51:00', 'user2', 'host2'),
    ('2019-08-25T05:51:00', 'user2', 'host3'),
    ('2019-08-30T09:51:00', 'user2', 'host3'),
    ('2019-08-25T09:31:00', 'user3', 'host4'),
    ('2019-08-30T10:51:00', 'user3', 'host4'),
    ('2019-08-25T09:51:00', 'user3', 'host4'),
    ('2019-08-25T05:51:00', 'user3', 'host5'),
    ('2019-08-25T09:51:00', 'user4', 'host6'),
    ('2019-08-25T09:31:00', 'user4', 'host6'),
    ('2019-08-30T10:51:00', 'user4', 'host6'),
    ('2019-08-25T09:51:00', 'user4', 'host7'),
    ('2019-08-30T05:51:00', 'user4', 'host7');
GO

SELECT [LoginTimeUTC], [UserName], [HostName]
FROM [LoginRecords];

Now to your actual issue at hand. I am regarding your last query that does not return your desired results:

select username, hostname, max(logintimeutc)
from loginrecords
group by username, hostname
having count(distinct(hostname)) > 1

Instead of the HAVING-clause, you could add a WHERE-clause to filter only the usernames that are used with multiple hostnames.

select username, hostname, max(logintimeutc)
from loginrecords
where username in (select username
                   from loginrecords
                   group by username
                   having count(distinct hostname) > 1)
group by username, hostname

This gives the following results:

username      hostname      (No column name)
user1         host1         22/08/2019 9:51
user1         host2         30/08/2019 10:51
user2         host2         25/08/2019 9:51
user2         host3         30/08/2019 9:51
user3         host4         30/08/2019 10:51
user3         host5         25/08/2019 5:51
user4         host6         30/08/2019 10:51
user4         host7         30/08/2019 5:51