Search code examples
mysqlsqlsql-servert-sqllogparser

SQL query to group multiple groups


I'm parsing some IIS server logs (with LogParser) and I'm having a little trouble creating a query that will give me the aggregate count of each type of browser (user agent).

Here is my query so far:

SELECT COUNT(*) as totalHits, CS(User-Agent) as browser
FROM E:\Logs\ex111101.log
WHERE (CS(User-Agent) LIKE '%ipad%' 
       OR CS(User-Agent) LIKE '%iphone%' 
       OR CS(User-Agent) LIKE '%blackberry%'
       OR CS(User-Agent) LIKE '%windows cs%'
       OR CS(User-Agent) LIKE '%android%')
AND cs-uri-stem LIKE '%.asp%'
GROUP BY browser
ORDER BY totalHits DESC

This givse me a list of user-agents like I want, and gives me a hit count for each group of browser:

Total Hits | Browser
467        | AndroidA 
45         | AndroidB 
23         | BlackberryC
233        | BlackberryD

What I want is THIS:

Total Hits | Browser 
512        | Android 
256        | Blackberry

Where All Android entries are counted and totaled under a generic Android row. In this case Total Hits for Android would be 467 + 45, Blackberry would be 233 = 33, etc.

From there I would want to provide a Percent column for each browser so I can represent the total hits as a percentage.

Any help is appreciated. Thanks!

*UPDATE

Followed the suggestion below but had to make a few tweaks in order for it to be executed correctly by LogParser. For some reason Log Parser didn't like the LIKE keyword in the CASE statement. The following worked fine though:

select
case strcnt(TO_LOWERCASE(cs(user-agent)),'android') WHEN 1 THEN 'Android' else
case strcnt(TO_LOWERCASE(cs(user-agent)),'ipad') WHEN 1 THEN 'iPad' else
case strcnt(TO_LOWERCASE(cs(user-agent)),'blackberry') WHEN 1 THEN 'Blackberry' else
case strcnt(TO_LOWERCASE(cs(user-agent)),'windows ce') WHEN 1 THEN 'Windows' else
case strcnt(TO_LOWERCASE(cs(user-agent)),'iphone') WHEN 1 THEN 'iPhone' 
ELSE 'Non-Mobile' End End End End End as Browser,
count(*) as TotalHits
from MYLOG
group by Browser
order by TotalHits desc

Solution

  • try

    select
          case when cs(User-Agent) like "%android%" then "Android"
               when cs(User-Agent) like "%black%" then "Blackberry"
               when cs(User-Agent) like "%windows%" then "Windows"
               when cs(User-Agent) like "%iphone%" then "iPhone"
               else "Other" end as Browser,
          count(*) as TotalHits
       from
          YourTable.logFile
       group by
          Browser
       order by
          TotalHits desc
    

    The group by and order by respect the ordinal column position instead of re-copying the entire case/when and count(*)... Since there's only two columns, no problem...