On 10/11/2011 12:26 PM, Paul Halliday wrote:
On Tue, Oct 11, 2011 at 10:37 AM, Peter Brawley
wrote:
On 10/11/2011 8:11 AM, Paul Halliday wrote:
I have the following query:
SELECT COUNT(signature) AS count, MAX(timestamp) AS maxTime,
INET_NTOA(src_ip), map1.cc as src_cc, INET_NTOA(dst_ip), ma
- Original Message -
> From: "Paul Halliday"
>
> Is it OK to keep adding to those joins? In a view there could be say
> 50 countries. The user can keep on adding more to exclude. So would I
> just expand on the ANDs like so:
>
> AND map1.cc !='CA' AND map1.cc !='US' AND map1.cc !='LV'...
On Tue, Oct 11, 2011 at 10:37 AM, Peter Brawley
wrote:
> On 10/11/2011 8:11 AM, Paul Halliday wrote:
>>
>> I have the following query:
>>
>> SELECT COUNT(signature) AS count, MAX(timestamp) AS maxTime,
>> INET_NTOA(src_ip), map1.cc as src_cc, INET_NTOA(dst_ip), map2.cc as
>> dst_cc, signature, sig
On 10/11/2011 8:11 AM, Paul Halliday wrote:
I have the following query:
SELECT COUNT(signature) AS count, MAX(timestamp) AS maxTime,
INET_NTOA(src_ip), map1.cc as src_cc, INET_NTOA(dst_ip), map2.cc as
dst_cc, signature, signature_id, ip_proto FROM event LEFT JOIN
mappings AS map1 ON event.src_ip
I have the following query:
SELECT COUNT(signature) AS count, MAX(timestamp) AS maxTime,
INET_NTOA(src_ip), map1.cc as src_cc, INET_NTOA(dst_ip), map2.cc as
dst_cc, signature, signature_id, ip_proto FROM event LEFT JOIN
mappings AS map1 ON event.src_ip = map1.ip LEFT JOIN mappings AS map2
ON event