Question

I have below click_log table logging hits for some urls

site    ip    ua    direction   hit_time
-----------------------------------------------------
 1      127.0.0.1      1         20010/01/01 00:00:00

 2      127.0.0.1      1         20010/01/01 00:01:00

 3      127.0.0.1      0         20010/01/01 00:10:00

....    .........

I want to select incoming hits (direction:1) and group by sites that are:

• from same ip and browser
• logged within 10 minutes of each other
• occured more than 4 times in 10 minutes.

I’m not sure if above was clear enough. English is not my first language. Let me try to explain with an example.

If site 1 gets 5 hits from same ip and browser with in 10 minutes after getting first unique hit from that ip and browser i want it to be included in the selection.

Basically I am trying to find abusers.

Answer 1

I think this does what you need. I have included some sample data too.

Create Table #t
(
[Site] int,
IP varchar(20),
Direction int,
Hit_Time datetime
)

Insert Into #t
Values (1,'127.0.0.1',1,'2010-01-01 00:00:00')

Insert Into #t
Values (1,'127.0.0.1',1,'2010-01-01 00:01:00')

Insert Into #t
Values (1,'127.0.0.1',1,'2010-01-01 00:03:00')

Insert Into #t
Values (1,'127.0.0.1',1,'2010-01-01 00:04:00')


Insert Into #t
Values (2,'127.0.0.2',1,'2010-01-01 00:00:00')

Insert Into #t
Values (2,'127.0.0.2',1,'2010-01-01 00:01:00')

Insert Into #t
Values (2,'127.0.0.2',0,'2010-01-01 00:03:00')

Insert Into #t
Values (2,'127.0.0.2',1,'2010-01-01 00:04:00')


Select Distinct Site
From #t
Where Direction = 1
Group by Site, IP
Having (DateDiff(minute,Min(HIt_Time), max(hit_time)) <= 10) And Count(*) >= 4

Drop Table #t