KQL summarize by count and then filter - kql

The goal of my query is to see if at any given minute we have more than 500 logs.
I have this line at the end | summarize count() by bin(env_time, 1m), but now I want to know if I can add filtering beyond that to only see rows with more than 500 results. Something along the lines of:
| totals = summarize count() by bin(env_time, 1m)
| where totals>500
Is there a way to do this correctly in KQL?
TIA

let t = materialize(range i from 1 to 9700 step 1 | extend env_time = ago(20m * rand()));
t
| summarize count() by bin(env_time, 1m)
| where count_ > 500
env_time
count_
2023-01-08T09:54:00Z
531
2023-01-08T09:56:00Z
501
2023-01-08T09:57:00Z
501
2023-01-08T10:00:00Z
510
2023-01-08T10:03:00Z
502
Fiddle
or (with alias for count())
let t = materialize(range i from 1 to 9700 step 1 | extend env_time = ago(20m * rand()));
t
| summarize rows_per_minute = count() by bin(env_time, 1m)
| where rows_per_minute > 500
env_time
rows_per_minute
2023-01-08T09:51:00Z
539
2023-01-08T09:57:00Z
501
2023-01-08T10:02:00Z
516
Fiddle

Related

Select value based on computation of column value and aggregate

I'm trying to build a Grafana Dashboard to understand what SQL queries are processed by my PostgreSQL server. I'm using the pg_stats_statements extension.
This is the query I currently have:
SELECT
query,
calls,
FROM pg_stat_statements
ORDER BY calls DESC limit 3;
Which gets me these results:
query | calls
---------+--------
Query 1 | 500000
Query 2 | 250000
Query 3 | 250000
Now, I'd like to select an additional value, in addition to calls, to see the share of each calls value compared to sum(calls) on all rows. This is the expected output:
query | calls | share
---------+--------+------ # 1 000 000 total calls
Query 1 | 500000 | 0.5 # 500 000 / 1 000 000
Query 2 | 250000 | 0.25 # 250 000 / 1 000 000
Query 3 | 250000 | 0.25 # 250 000 / 1 000 000
Is it possible to do that and if yes, how can I rewrite my query to get this output?
WITH sum_query AS MATERIALIZED
(select sum(calls) as call_sum from pg_stat_statements)
select
ps.query,
sum(ps.calls),
avg(round((ps.total_time/ps.calls)::numeric,2)) as mean_time,
sum(ps.calls) / (select call_sum from sum_query) as "share"
from pg_stat_statements ps
group by ps.query
In this query, I use WITH AS MATERIALIZED for performance.

select from table with between

please, help advice.
I have a table.
id|score_max|score_min| segment
--|---------|---------|--------
1 |264 | |girl
2 |263 | 250 |girl+
3 |249 | 240 |girl
4 | | 239 |girl
It is not necessary to obtain a value depending on the value of the score.
But it can be null.
For example, 260 is value from other table
select segment
from mytable
where score_max<260 and score_min>260
Output:
2 |263 | 250 |girl+
but if value =200, sql is not correct
How to make a request correctly?
For this sample data that makes more sense:
id|score_max|score_min| segment
--|---------|---------|--------
1 | | 264 |girl
2 |263 | 250 |girl+
3 |249 | 240 |girl
4 |239 | |girl
you can get the result that you want like this:
select *
from tablename
where
(? >= score_min or score_min is null)
and
(? <= score_max or score_max is null)
Replace ? with the value that you search for.
See the demo.

Query a table so that data in one column could be shown as different fields

I have a table that stores data of customer care . The table/view has the following structure.
userid calls_received calls_answered calls_rejected call_date
-----------------------------------------------------------------------
1030 134 100 34 28-05-2018
1012 140 120 20 28-05-2018
1045 120 80 40 28-05-2018
1030 99 39 50 28-04-2018
1045 50 30 20 28-04-2018
1045 200 100 100 28-05-2017
1030 160 90 70 28-04-2017
1045 50 30 20 28-04-2017
This is the sample data. The data is stored on day basis.
I have to create a report in a report designer software that takes date as an input. When user selects a date for eg. 28/05/2018. This date is send as parameter ${call_date}. i have to query the view in such a way that result should look like as below. If user selects date 28/05/2018 then data of 28/04/2018 and 28/05/2017 should be displayed side by side as like the below column order.
userid | cl_cur | ans_cur | rej_cur |success_percentage |diff_percent|position_last_month| cl_last_mon | ans_las_mon | rej_last_mon |percentage_lm|cl_last_year | ans_last_year | rej_last_year
1030 | 134 | 100 | 34 | 74.6 % | 14% | 2 | 99 | 39 | 50 | 39.3% | 160 | 90 | 70
1045 | 120 | 80 | 40 | 66.6% | 26.7% | 1 | 50 | 30 | 20 | 60% | 50 | 30 | 20
The objective of this query is to show data of selected day, data of same day previous month and same day previous years in columns so that user can have a look and compare. Here the result is ordered by percentage(ans_cur/cl_cur) of selected day in descending order of calculated percentage and show under success_percentage.
The column position_last_month is the position of that particular employee in previous month when it is ordered in descending order of percentage. In this example userid 1030 was in 2nd position last month and userid 1045 in 1 st position last month. Similarly I have to calculate this also for year.
Also there is a field called diff_percent which calculates the difference of percentage between the person who where in same position last month.Same i have to do for last year. How i can achieve this result.Please help.
THIS ANSWERS THE ORIGINAL VERSION OF THE QUESTION.
One method is a join:
select t.user_id,
t.calls_received as cr_cur, t.calls_answered as ca_cur, t.calls_rejected as cr_cur,
tm.calls_received as cr_last_mon, tm.calls_answered as ca_last_mon, tm.calls_rejected as cr_last_mon,
ty.calls_received as cr_last_year, ty.calls_answered as ca_last_year, ty.calls_rejected as cr_last_year
from t left join
t tm
on tm.userid = t.userid and
tm.call_date = dateadd(month, -1, t.call_date) left join
t ty
on ty.userid = t.userid and
tm.call_date = dateadd(year, -1, t.call_date)
where t.call_date = ${call_date};

sum revenue based on criteria form another table Powerpivot

I have a model where I have Revenue table that has revenue2016 column
another table Programs where i have
program | min
I would like to add a calculated column to programs table so that it sums revenue that is grater than the min like so
=CALCULATE(SUM(Revenue[revenue2016 ]),Revenue[revenue2016]>=Programs[min])
this gave me an error
The data should look like this
#Revenue
Revenue
10
10
10
10
10
100
100
100
100
100
1000
1000
1000
1000
1000
#Programs
program | min | summed rev
a | 10 | 5550
b | 100 | 5500
c | 1000 | 5000
Just After I posted it I found the answer, I'll share it if someone else came across same issue
=calculate(sum(Revenue[revenue2016]),filter(Revenue,Revenue[revenue2016]>=Programs[Min]))

Oracle, Mysql, how to get average

How to get Average fuel consumption only using MySQL or Oracle:
SELECT te.fuelName,
zkd.fuelCapacity,
zkd.odometer
FROM ZakupKartyDrogowej zkd
JOIN TypElementu te
ON te.typElementu_Id = zkd.typElementu_Id
AND te.idFirmy = zkd.idFirmy
AND te.typElementu_Id IN (3,4,5)
WHERE zkd.idFirmy = 1054
AND zkd.kartaDrogowa_Id = 42
AND zkd.data BETWEEN to_date('2015-09-01','YYYY-MM-DD')
AND to_date('2015-09-30','YYYY-MM-DD');
Result of this query is:
fuelName | fuelCapacity | odometer | tanking
-------------------------------------------------
'ON' | 534 | 1284172 | 2015-09-29
'ON' | 571 | 1276284 | 2015-09-02
'ON' | 470 | 1277715 | 2015-09-07
'ON' | 580.01 | 1279700 | 2015-09-11
'ON' | 490 | 1281103 | 2015-09-17
'ON' | 520 | 1282690 | 2015-09-23
We can do it later in java or php, but want to get result right away from query. How should we modify above query to do that?
fuelCapacity is the number of liters of fuel that has been poured into cartank at gas station.
For one total average, what you need is the sum of the refills divided by the difference between the odometer readings at the start and the end, i.e. fuel used / distance travelled.
I don't have your table structure at hand, but this alteration to the select statement should do the trick:
select cast(sum(zkd.fuelCapacity) as float) / (max(zkd.odometer) - min(zkd.odometer)) as consumption ...
The cast(field AS float) does what the name implies, and typecasts the field as float, so the result will also be a float. (I do suspect that your fuelCapacity field is a float because there is one float value in your example, but this will make sure.)