select
decode(a.alarmtype,100,'硬盘变更事件',2000,'杀毒软件事件',2002,'设备监控事件',2003,'硬件监视事件',2004,'软件监视事件',2005,'主机防火墙事件',
2006,'HTTP访问事件',2007,'外联监控事件',2008,'网络配置监控事件',2009,'流量控制事件',2010,'系统性能事件',2011,'拨号监控事件',
2012,'文件监视事件',2013,'补丁自动下发事件',2014,'打印监控事件',2015,'进程监视事件',2016,'端口监视事件',
2017,'共享监视事件',2018,'USB监视事件',2020,'流量统计事件',2022,'文档检查事件',2023,'网络准入事件','未知事件') as LABEL,
count(a.alarmtype) as VALUE
from td_eventinfo a
where substr(a.groupurl,instr(a.groupurl, '/', -1, 1) + 1) = 'td'
and a.creationtime BETWEEN to_date('20130304','yyyyMMdd') AND to_date('20130326','yyyyMMdd')
group by a.alarmtype
order by count(a.alarmtype) desc