Re: [DISCUSS] Profiler Enhancement

Scenario 2 is one that I'm specifically interested in, I have that exact use case right now. I can see Scenario 1 being useful in the future as well. I'm also interested in a conversation along the lines of what Otto brought up (i.e. I would like to re-ingest data to redo parsing, enrichments,

Re: [DISCUSS] Profiler Enhancement

I think that is fine, we can use that and work out the UX to manage new or replace. Maybe we can do Profile Compare down the line? On February 5, 2018 at 09:28:16, Nick Allen (n...@nickallen.org) wrote: > If we replay a set of data with a new version of a profile I think it will always have to

Re: [DISCUSS] Profiler Enhancement

> If we replay a set of data with a new version of a profile I think it will always have to be a new profile and not ‘replace’ the old one. Series1, Seriers2 etc? As part of this effort (unless there is a compelling reason) I wouldn't change that behavior. The profile data is stored based on

Re: [DISCUSS] Profiler Enhancement

You know, I am going to back this up. I usually thing of replay as replay, profiler or not, but that is not true. Replay of data through the full pipeline (parsers/enrichement) has more consequences or concerns, so we can drop this. I don’t want to expand the scope of your idea. We can

Re: [DISCUSS] Profiler Enhancement

I think that is definitely a reasonable extension. In this case would we need any additional actions to indicate that data will be overwritten? I am trying to think of other additional needs that this use case has over the others. On Feb 2, 2018 12:38 PM, "Otto Fowler"

Re: [DISCUSS] Profiler Enhancement

Scenario 3: As a Security ? I have modified a profile or parser configuration ( replay is replay ), and I want to run the new version against my old data. On February 2, 2018 at 12:19:54, Nick Allen (n...@nickallen.org) wrote: I have been thinking about an enhancement to the Profiler for

[DISCUSS] Profiler Enhancement

I have been thinking about an enhancement to the Profiler for quite some time. Actually, my first pass at defining this was called "Replay Telemetry through Profiler" back in METRON-594 [1]. I'd like to first discuss the use case to make sure we start out on the right foot. Here is how I would