I have been thinking about an enhancement to the Profiler for quite some
time. Actually, my first pass at defining this was called "Replay
Telemetry through Profiler" back in METRON-594 [1].
I'd like to first discuss the use case to make sure we start out on the
right foot. Here is how I would d
Scenario 3:
As a Security ? I have modified a profile or parser configuration ( replay
is replay ), and I want to run the new version
against my old data.
On February 2, 2018 at 12:19:54, Nick Allen (n...@nickallen.org) wrote:
I have been thinking about an enhancement to the Profiler for quite
I think that is definitely a reasonable extension.
In this case would we need any additional actions to indicate that data
will be overwritten?
I am trying to think of other additional needs that this use case has over
the others.
On Feb 2, 2018 12:38 PM, "Otto Fowler" wrote:
> Scenario 3:
> A
You know, I am going to back this up.
I usually thing of replay as replay, profiler or not, but that is not true.
Replay of data through the full pipeline (parsers/enrichement) has more
consequences or concerns, so we can drop this.
I don’t want to expand the scope of your idea. We can reuse/refac
> If we replay a set of data with a new version of a profile I think it
will always have to be a new profile and not ‘replace’ the old one.
Series1, Seriers2 etc?
As part of this effort (unless there is a compelling reason) I wouldn't
change that behavior. The profile data is stored based on pro
I think that is fine, we can use that and work out the UX to manage new or
replace. Maybe we can do Profile Compare down the line?
On February 5, 2018 at 09:28:16, Nick Allen (n...@nickallen.org) wrote:
> If we replay a set of data with a new version of a profile I think it
will always have to
Scenario 2 is one that I'm specifically interested in, I have that exact
use case right now. I can see Scenario 1 being useful in the future as
well.
I'm also interested in a conversation along the lines of what Otto brought
up (i.e. I would like to re-ingest data to redo parsing, enrichments, et