Psql - 错误：列“avclass”不存在 - 为分组的列选择计数和百分比

Question

这是我想要做的查询。 我不是 psql 的专家。

SELECT avclassfamily, count(*) as countis, totalcount, percentage  
FROM malwarehashesandstrings 
where lol=True 
group by avclassfamily 
ORDER BY countis DESC;

avclassfamily = 那个字符串

count(*) = 总计数，其中 lol=true

totalcount = count where lol=true or lol=false 对于那个特定的 avclassfamily

百分比 = 占总数的百分比

这是我使用的第一个命令

SELECT avclassfamily, count(*) as countis 
FROM malwarehashesandstrings 
where lol=True 
group by avclassfamily 
ORDER BY countis DESC;

这是上面命令的output：

 avclassfamily      | countis 
------------------------+---------
 autoit                 |     677
 cosmu                  |     226
 SINGLETON              |     223
 plingky                |     195
 fakepav                |     186

这是我试图更接近我正在寻找的东西：

SELECT avclassfamily as avclass, count(*) as countis, 
       (select count(*) 
        FROM malwarehashesandstrings 
        where avclassfamily=avclass) as percent 
from malwarehashesandstrings 
where lol=True 
group by avclassfamily 
ORDER BY countis DESC;

正确的 sql 是：

select avclassfamily as avclass, 
       count(*) as countis,
       sum(case when avclassfamily = avclassfamily and lol=True then 1 else 0 end) as lolnumber , 
       case 
         sum(case when avclassfamily = avclassfamily and lol=True then 1 else 0 end) when 0 
           then NULL 
         else (sum(case when avclassfamily = avclassfamily and lol=True then 1 else 0 end) * 100 / count(*) ) 
       end as percentage
from malwarehashesandstrings 
group by avclassfamily 
order by percentage desc NULLS LAST;

Answer 1

您不需要列上的subquery ，您需要的是sum和select case

select avclassfamily as avclass
, count(*) as countis,
sum(case when avclassfamily = avclassfamily and lol=True then 1 else 0 end) as lolnumber
, 
case sum(case when avclassfamily = avclassfamily and lol=True then 1 else 0 end) when 0 then NULL else (sum(case when avclassfamily = avclassfamily and lol=True then 1 else 0 end) * 100 / count(*) ) end as percentage

来自恶意软件哈希和字符串组，按 avclassfamily 顺序按百分比 desc NULLS LAST；