Hi Sergio,
The sql_history drives temporal aggregation by splitting traffic data
into time-bins. You configured 5 minutes time-bins. See the behaviour
of the 'stamp_inserted' field, ie. do SELECT DISTINCT(stamp_inserted)
FROM table ORDER BY stamp_inserted, to get this more clear. The
roundoff
Thanks Paolo,
Creating index decreased query time from 1min to 5 sec hehe.
The searchs are often by ip_src and ip_dst, between 2 dates
(stamp_inserted). I think that indexes just for ip_src and ip_dst are fine.
Cheers.
2010/4/28 Paolo Lucente pa...@pmacct.net
Hi Sergio,
The sql_history
