number1= AnyNumber from 1 to 100
number2= AnyNumber from 1 to 100,
This is how my data looks in Splunk
{[-]
field1: number1,
fiedl2: number2,
...
}
I want to check if these two fields match or doesn't,
my Splunk Query
| search filed1 != field2
| stats count by field1,field2
Try using where with match:
<spl>
| where !match(field1,field2)
| stats count by field1 field 2
After adding the single quotes around the field2. I was able to get the data
for the list of fields that are not matching!
| where field1 != 'field2' | stats count by field1, field2
Related
I have a SQLite database and I want to order my results by ascending order of a String column (name). I want the null-valued rows to be last in ascending order.
Moreover, I am doing some filtering on the same column (WHERE name>"previously obtained value"), which filters out the NULL-valued rows, which I do not want. Plus, the version of SQLite I'm using (I don't have control over this) does not support NULLS LAST. Therefore, to keep it simple I want to use IFNULL(name,"Something") in my ORDER BY and my comparison.
I want this "Something" to be as large as possible, so that my null-valued rows are always last. I have texts in Japanese and Korean, so I can't just use "ZZZ".
Therefore, I see two possible solutions. First, use the "maximum" character used by SQLite in the default ordering of strings, do you know what this value is or how to obtain it? Second, as the cells can contain any type in SQLite, is there a value of any other type that will always be considered larger than any string?
Example:
+----+-----------------+---------------+
| id | name | othercol |
+----+-----------------+---------------+
| 1 | English name | hello |
| 2 | NULL | hi |
| 3 | NULL | hi hello |
| 4 | 暴鬼 | hola |
| 5 | NULL | bonjour hello |
| 6 | 아바키 | hello bye |
+----+-----------------+---------------+
Current request:
SELECT * FROM mytable WHERE othercol LIKE "hello" AND (name,id)>("English name",1) ORDER BY (name,id)
Result (by ids): 6
Problems: NULL names are filtered out because of the comparison, and when I have no comparison they are shown first.
What I think would solve these problems:
SELECT * FROM mytable WHERE othercol LIKE "hello" AND (IFNULL(name,"Something"),id)>("English name",1) ORDER BY (IFNULL(name,"Something"),id)
But I need "Something" to be larger than any string I might encounter.
Expected result: 6, 3, 5
I think a simpler way is to use nulls last:
order by column nulls last
This works with both ascending and descending sorts. And it has the advantage that it can make use of an index on the column, which coalesce() would probably prevent.
Change your WHERE clause to:
WHERE SOMECOL > "previously obtained value" OR SOMECOL IS NULL
so the NULLs are not filtered out (since you want them).
You can sort the NULLs last, like this:
ORDER BY SOMECOL IS NULL, SOMECOL
The expresssion:
SOMECOL IS NULL
evaluates to 1 (True) or 0 (False), so the values that are not NULL will be sorted first.
Edit
If you want a string that is greater than any name in the table, then you can get it by:
select max(name) || ' ' from mytable
so in your code use:
ifnull(name, (select max(name) || ' ' from mytable))
Finally found a solution, for anyone looking for a character larger than any other (when I'm posting this, the unicode table might get expanded), here's your guy:
CAST(x'f48083bf' AS TEXT).
Example in my case:
SELECT * FROM mytable WHERE othercol LIKE "hello" AND (IFNULL(name,CAST(x'f48083bf' AS TEXT)),id)>("English name",1) ORDER BY (IFNULL(name,CAST(x'f48083bf' AS TEXT)),id)
I have a table like this:
I want to perform count on different set of columns (all subsets where there is at least one element from X and one element from Y). How can I do that in Postgres?
For example, I may have {x1,x2,y3}, {x4,y1,y2,y3},etc. I want to count number of "id"s having 1 in each set. So for the first set:
SELECT COUNT(id) FROM table WHERE x1=1 AND x2=1 AND x3=1;
and for the second set does the same:
SELECT COUNT(id) FROM table WHERE x4=1 AND y1=1 AND y2=1 AND y3=1;
Is it possible to write a loop that goes over all these sets and query the table accordingly? The array will have more than 10000 sets, so it cannot be done manually.
You should be able convert the table columns to an array using ARRAY[col1, col2,...], then use the array_positions function, setting the second parameter to be the value you're checking for. So, given your example above, this query:
SELECT id, array_positions(array[x1,x2,x3,x4,y1,y2,y3,y4], 1)
FROM tbl
ORDER BY id;
Will yield this result:
+----+-------------------+
| id | array_positions |
+----+-------------------+
| a | {1,4,5} |
| b | {1,2,4,7} |
| c | {1,2,3,4,6,7,8} |
+----+-------------------+
Here's a SQL Fiddle.
I have a table called products with the following schema and data:
| product_id | name | description | price | location |
| NUMBER | VARCHAR2 | CLOB |NUMBER(9,2)| SDO_GEOMETRY |
--------------------------------------------------------------------------
| 27 | Nexus 4 | Android phone | 160 | null |
When I issue a SELECT * FROM products; query, I get the data back. All is well. But I want to be able to get results back using CONTAINS() in a where, like this:
SELECT "PRODUCT_ID", "NAME", "DESCRIPTION", "PRICE"
FROM "PRODUCTS"
WHERE CONTAINS("NAME", 'nexus') > 0;
However I'm getting no results back. The same thing happens when I change nexus to Nexus or Nexus 4. I thought it might be something to do with name being a resolved word, but the same thing happens with the description column.
Turns out this is because I had two text indexes on the same table, for name and description. I removed the one for description and it worked.
If you don't use mixed/lower case table and column names, all of the " characters can be removed in your query ...
SELECT product_id, name, description, price FROM product WHERE CONTAINS(name, '%Nexus%') > 0;
I have a table which has got a field which has many "Item numbers" (starting from 8%, 2%, etc...). These Item numbers have further components, which are also stored in the very same column (because each component is also an Item). Now the requirement is to if I encounter an Item number that has its component number starting from 8%, then I need to create a new column against the Main Item number (some thing which is called 800-Level Items) and store it there, and if the main Item Number has 2% component number then i should put it into yet another column something like (200-Level).
Field1 XLike YLike
---------------------
(Main Item) XXXX
(Main Item's component)YYYY
(Main Item's component)ZZZZ
(Main Item's component)XABC
(Main Item's component)YABC
Now depending upon the starting character of the Sting in Field1, I need to segregate the values in fields XLike and YLike in following manner:
Field1 | XLike | YLike
-------------------------
XXXX | XABC |
YYYY | | YABC
ZZZZ | |
XABC | |
YABC | |
for 10g you can try
select
wm_concat(case when field1 like '%X%' then field1 end) XLike,
wm_concat(case when field1 like '%Y%' then field1 end) YLike
from table1
11g has listagg function
select listagg(case when field1 like '%X%' then field1 end, ';') within group(order by field1) XLike,
listagg(case when field1 like '%Y%' then field1 end, ';') within group(order by field1) YLike
from table1
I'm trying to find a way to match a query to a regular expression in a database. As far as I can tell (although I'm no expert), while most DBMS like MySQL have a regex option for searching, you can only do something like:
Find all rows in Column 1 that match the regex in my query.
What I want to be able to do is the opposite, i.e.:
Find all rows in Column 1 such that the regex in Column 1 matches my query.
Simple example - say I had a database structured like so:
+----------+-----------+
| Column 1 | Column 2 |
+----------+-----------+
| [a-z]+ | whatever |
+----------+-----------+
| [\w]+ | whatever |
+----------+-----------+
| [0-9]+ | whatever |
+----------+-----------+
So if I queried "dog", I would want it to return the rows with [a-z]+ and [\w]+, and if I queried 123, it would return the row with [0-9]+.
If you know of a way to do this in SQL, a short SELECT example or a link with an example would be much appreciated.
For MySQL (and may be other databases too):
SELECT * FROM table WHERE "dog" RLIKE(`Column 1`)
In PostgreSQL it would be:
SELECT * FROM table WHERE 'dog' ~ "Column 1";