StarRocks审计日志中提取消耗计算资源最高的owner

审计日志中可以添加owner字段-- from:Service,app:App,owner:Jack,queryGuid:926433720462532608,key:20260731 -- EOF --from:data;owner:Jack;qid:20260731;--EOF --dtquery:Jack--qid:20260731-111651-1752b0c5-2296-4f7f-9eb3-a13d23077aab--EOF select * from data.metric limit 1使用如下SQL统计SELECT owner, COUNT(*) AS query_cnt, SUM(cpuCostNs) AS total_cpu_cost_ns, ROUND(SUM(cpuCostNs) / 1e9, 2) AS total_cpu_sec, ROUND(AVG(cpuCostNs) / 1e9, 2) AS avg_cpu_sec, MAX(cpuCostNs) AS max_cpu_cost_ns FROM ( SELECT cpuCostNs, regexp_extract(stmt, owner:([a-zA-Z0-9_]), 1) AS owner FROM starrocks_audit_db__.starrocks_audit_tbl__ WHERE timestamp CURDATE() AND timestamp DATE_ADD(CURDATE(), INTERVAL 1 DAY) AND cpuCostNs 0 AND stmt REGEXP owner:[a-zA-Z0-9_] ) t WHERE owner ! GROUP BY owner ORDER BY total_cpu_cost_ns DESC LIMIT 10;