Re: Inconsistent query result.

2011-10-11 Thread Peter Brawley
On 10/11/2011 12:26 PM, Paul Halliday wrote: On Tue, Oct 11, 2011 at 10:37 AM, Peter Brawley wrote: On 10/11/2011 8:11 AM, Paul Halliday wrote: I have the following query: SELECT COUNT(signature) AS count, MAX(timestamp) AS maxTime, INET_NTOA(src_ip), map1.cc as src_cc, INET_NTOA(dst_ip), ma

Re: Inconsistent query result.

2011-10-11 Thread Johan De Meersman
- Original Message - > From: "Paul Halliday" > > Is it OK to keep adding to those joins? In a view there could be say > 50 countries. The user can keep on adding more to exclude. So would I > just expand on the ANDs like so: > > AND map1.cc !='CA' AND map1.cc !='US' AND map1.cc !='LV'...

Re: Inconsistent query result.

2011-10-11 Thread Paul Halliday
On Tue, Oct 11, 2011 at 10:37 AM, Peter Brawley wrote: > On 10/11/2011 8:11 AM, Paul Halliday wrote: >> >> I have the following query: >> >> SELECT COUNT(signature) AS count, MAX(timestamp) AS maxTime, >> INET_NTOA(src_ip), map1.cc as src_cc, INET_NTOA(dst_ip), map2.cc as >> dst_cc, signature, sig

Re: Inconsistent query result.

2011-10-11 Thread Peter Brawley
On 10/11/2011 8:11 AM, Paul Halliday wrote: I have the following query: SELECT COUNT(signature) AS count, MAX(timestamp) AS maxTime, INET_NTOA(src_ip), map1.cc as src_cc, INET_NTOA(dst_ip), map2.cc as dst_cc, signature, signature_id, ip_proto FROM event LEFT JOIN mappings AS map1 ON event.src_ip

Inconsistent query result.

2011-10-11 Thread Paul Halliday
I have the following query: SELECT COUNT(signature) AS count, MAX(timestamp) AS maxTime, INET_NTOA(src_ip), map1.cc as src_cc, INET_NTOA(dst_ip), map2.cc as dst_cc, signature, signature_id, ip_proto FROM event LEFT JOIN mappings AS map1 ON event.src_ip = map1.ip LEFT JOIN mappings AS map2 ON event