Re: Profiler statistics NaN

2017-08-09 Thread Otto Fowler
A couple of things come to mind, in no order * Higher level compositing functions that bring all these things together… maybe packaged as a snazzy extension ;) * A more ‘structured’ version of the stellar shell text file input, where you could configure variables in the file and just run it, so

Re: Profiler statistics NaN

2017-08-09 Thread Nick Allen
I like it, Otto. I see the recipe idea implemented as a collection of GUI wizards. The user can login to a web interface and choose from a collection of recipes. The user interacts with a recipe via a GUI wizard-like mechanism. The wizard gathers the input needed from the user to implement a

Re: Profiler statistics NaN

2017-08-09 Thread Casey Stella
Well, we need that too :) What're you thinking, procedures for stellar? On Wed, Aug 9, 2017 at 4:42 PM, Otto Fowler wrote: > What we need, is a way to package up some ‘recipes’ for stellar. > If many people are going to do this operation, then a more friendly set of >

Re: Profiler statistics NaN

2017-08-09 Thread Otto Fowler
What we need, is a way to package up some ‘recipes’ for stellar. If many people are going to do this operation, then a more friendly set of facade functions, or some thing would work. On August 9, 2017 at 16:38:48, Casey Stella (ceste...@gmail.com) wrote: Yeah, I'm leaning toward STATS_ADD or

Re: Profiler statistics NaN

2017-08-09 Thread Casey Stella
Yeah, I'm leaning toward STATS_ADD or STATS_INIT taking a list of numbers. STATS_MERGE seems confusing. On Wed, Aug 9, 2017 at 4:37 PM, Nick Allen wrote: > Or even change the behavior of STATS_MERGE, too? If STATS_MERGE gets raw > numbers, it wraps those in a Stats object,

Re: Profiler statistics NaN

2017-08-09 Thread Nick Allen
Or even change the behavior of STATS_MERGE, too? If STATS_MERGE gets raw numbers, it wraps those in a Stats object, then returns it. Then Dima's example would just work as-is. I'm not sure I like that though. Maybe so flexible as to be confusing? Thought I would throw it out as an alternative

Re: Profiler statistics NaN

2017-08-09 Thread Nick Allen
Oh yeah, duh. Now I'm with you. That would be a good quick hit. The current behavior is a little nutty. If there is a list, it only consumes the first element in the list. I'd expect that it should either do what you describe or complain that it doesn't know how to handle a list. Easy fix

Re: Profiler statistics NaN

2017-08-09 Thread Casey Stella
outcoming is still a HLLP object, not a statistics object, so doing a STATS_MERGE on a bunch of them wouldn't work either. On Wed, Aug 9, 2017 at 4:15 PM, Nick Allen wrote: > That is another problem. Isn't the simplest answer, to just change this... > > "result":

Re: Profiler statistics NaN

2017-08-09 Thread Nick Allen
That is another problem. Isn't the simplest answer, to just change this... "result": "HLLP_CARDINALITY(outcoming)" to this... "result": "outcoming" ? On Wed, Aug 9, 2017 at 3:48 PM Casey Stella wrote: > Ok, so the problem here is that your profile is returning integers

Re: Profiler statistics NaN

2017-08-09 Thread Casey Stella
Ok, so the problem here is that your profile is returning integers (specifically HLLP cardinalities) rather than stats objects. When you're doing: STATS_PERCENTILE(STATS_MERGE( PROFILE_GET('host-talks-to', '99.191.183.156', PROFILE_FIXED(10, 'HOURS')), 90) You are calling STATS_MERGE on a

Re: Profiler statistics NaN

2017-08-09 Thread Nick Allen
It seems that you are using the Profiler Client API correctly from the REPL, but you are using it incorrectly in your triage rules. Change your triage rules to match what you ran in the REPL. Correct: PROFILE_GET( "host-talks-to" , "99.191.183.156", PROFILE_FIXED(300, "MINUTES")) Incorrect:

Profiler statistics NaN

2017-08-09 Thread Dima Kovalyov
Hello Metron Team, I have created following profiler: > { > "profile": "host-talks-to", > "onlyif": "exists(source_ip)", > "foreach": "source_ip", > "init": { > "outcoming": "HLLP_INIT(5, 6)" > }, > "update": { "outcoming": "HLLP_ADD(outcoming, destination_ip)" }, >