[英]Mysql: Select specific data from multiple joined tables
我在思考這個 select 語句時遇到了麻煩。 數據來自 3 個表(為了便於閱讀,我刪除了所有不必要的數據):
mysql> describe vulnerability;
+---------------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+---------------+------------------+------+-----+---------+----------------+
| vuln_id | int(10) unsigned | NO | PRI | NULL | auto_increment |
| severity | int(10) unsigned | NO | | NULL | |
| host_id | int(10) unsigned | NO | MUL | NULL | |
+---------------+------------------+------+-----+---------+----------------+
mysql> describe cve;
+---------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+---------+------------------+------+-----+---------+----------------+
| cve_id | int(10) unsigned | NO | PRI | NULL | auto_increment |
| cve | varchar(15) | NO | | NULL | |
| vuln_id | int(10) unsigned | NO | MUL | NULL | |
| year | int(4) unsigned | YES | | NULL | |
+---------+------------------+------+-----+---------+----------------+
mysql> describe host;
+--------------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+--------------+------------------+------+-----+---------+----------------+
| host_id | int(10) unsigned | NO | PRI | NULL | auto_increment |
| ip_addr | int(10) unsigned | NO | | NULL | |
+--------------+------------------+------+-----+---------+----------------+
我想輸出具有小於 2009 年且嚴重性 = 3 的漏洞的主機數量。該年份包含在 CVE 中,它與具有 vuln_id FK 的漏洞相關聯。 該漏洞具有嚴重性,並與具有 host_id FK 的 Host 相關聯。 這是我到目前為止所擁有的:
mysql> select count(distinct ip_addr) from host H
inner join vulnerability V on H.host_id = V.host_id
inner join CVE C on C.vuln_id = V.vuln_id
where V.severity = 3 and C.year < 2009;
+-------------------------+
| count(distinct ip_addr) |
+-------------------------+
| 5071 |
+-------------------------+
這告訴我存在早於 2009 年的漏洞的主機總數,這是一個好的開始。 但是,我想更進一步,只包括那些有 50 個或更多漏洞的主機。 我不知道該怎么做。 Host 表中的每個主機條目都有多個對應的漏洞條目。 我想我需要在我的 where 子句中添加一些東西,但我被卡住了。
提前致謝。 如果需要更多信息,請告訴我。
嘗試使用GROUP BY
和HAVING
:
SELECT ip_addr
FROM host AS H
INNER JOIN vulnerability AS V
ON H.host_id = V.host_id
INNER JOIN CVE AS C
ON C.vuln_id = V.vuln_id
WHERE V.severity = 3 AND C.year < 2009
GROUP BY ip_addr
HAVING COUNT(DISTINCT vuln_id) >= 50
要獲得計數,請將上述查詢包裝在另一個查詢中:
SELECT COUNT(*) FROM
(
SELECT ip_addr
FROM host AS H
-- etc... same query as above
) T1
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.