[
https://issues.apache.org/jira/browse/METRON-903?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15991129#comment-15991129
]
ASF GitHub Bot commented on METRON-903:
---------------------------------------
Github user dlyle65535 commented on the issue:
https://github.com/apache/incubator-metron/pull/556
tl;dr - I'm +1 with the combined report, just wanted to understand the
trade space.
You have it right. I think the combined view is useful, but we probably
should do some noodling around what constitutes a unique event. The way I think
about is this (though I may be all wet).
If we have sufficient clock granularity, src/dst/time is unique.
If we don't then UNION ALL runs a risk of overcounting but UNION runs the
risk of undercounting.
Either way, I'm good and my default position would be to overcount.
> Create a connections report in Zeppelin
> ---------------------------------------
>
> Key: METRON-903
> URL: https://issues.apache.org/jira/browse/METRON-903
> Project: Metron
> Issue Type: New Feature
> Reporter: Justin Leet
> Assignee: Justin Leet
>
> User types in range into a search box
> System generates connections report:
> IP(A) -> IP(B) : # of times
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
