> Presumably those records were absorbed into your 'group by' clause, since
> there was an entry, from a later time, which had the same values for all the
> group by fields.
>
>
> --
> Simcha Younger
>
Geez, how obvious. I was thinking on a completely different plane. I
feel pretty silly now. :
On Thu, 4 Nov 2010 08:07:02 -0300
Paul Halliday wrote:
> SELECT COUNT(signature) AS count, MAX(timestamp) AS maxTime,
> INET_NTOA(src_ip), src.cc, INET_NTOA(dst_ip), dst.cc FROM event LEFT
> JOIN mappings AS src ON event.src_ip = src.ip LEFT JOIN mappings AS
> dst ON event.dst_ip = dst.ip WHERE
