StarRocks审计日志中提取消耗计算资源最高的owner

审计日志中可以添加owner字段：

-- from:Service,app:App,owner:Jack,queryGuid:926433720462532608,key:20260731 -- EOF --from:data;owner:Jack;qid:20260731;--EOF --dtquery:Jack--qid:20260731-111651-1752b0c5-2296-4f7f-9eb3-a13d23077aab--EOF select * from data.metric limit 1

使用如下SQL统计：

SELECT owner, COUNT(*) AS query_cnt, SUM(cpuCostNs) AS total_cpu_cost_ns, ROUND(SUM(cpuCostNs) / 1e9, 2) AS total_cpu_sec, ROUND(AVG(cpuCostNs) / 1e9, 2) AS avg_cpu_sec, MAX(cpuCostNs) AS max_cpu_cost_ns FROM ( SELECT cpuCostNs, regexp_extract(stmt, 'owner:([a-zA-Z0-9_]+)', 1) AS owner FROM starrocks_audit_db__.starrocks_audit_tbl__ WHERE `timestamp` >= CURDATE() AND `timestamp` < DATE_ADD(CURDATE(), INTERVAL 1 DAY) AND cpuCostNs > 0 AND stmt REGEXP 'owner:[a-zA-Z0-9_]+' ) t WHERE owner != '' GROUP BY owner ORDER BY total_cpu_cost_ns DESC LIMIT 10;