Github user dlyle65535 commented on the issue:
https://github.com/apache/incubator-metron/pull/556
tl;dr - I'm +1 with the combined report, just wanted to understand the
trade space.
You have it right. I think the combined view is useful, but we probably
should do some noodling around what constitutes a unique event. The way I think
about is this (though I may be all wet).
If we have sufficient clock granularity, src/dst/time is unique.
If we don't then UNION ALL runs a risk of overcounting but UNION runs the
risk of undercounting.
Either way, I'm good and my default position would be to overcount.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
