metron-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From dlyle65535 <...@git.apache.org>
Subject [GitHub] incubator-metron issue #556: METRON-903: Create a connections report in Zepp...
Date Mon, 01 May 2017 17:22:05 GMT
Github user dlyle65535 commented on the issue:

    https://github.com/apache/incubator-metron/pull/556
  
    tl;dr - I'm +1 with the combined report, just wanted to understand the trade space.
    
    You have it right. I think the combined view is useful, but we probably should do some
noodling around what constitutes a unique event. The way I think about is this (though I may
be all wet).
    
    If we have sufficient clock granularity, src/dst/time is unique.
    If we don't then UNION ALL runs a risk of overcounting but UNION runs the risk of undercounting.
    
    Either way, I'm good and my default position would be to overcount.


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---

Mime
View raw message