Checkpoint, don't try running this. It's broken all over the place.

scripts/base/frameworks/measurement/plugins/sample.bro

@@ -0,0 +1,45 @@
+
+module Measurement;
+
+export {
+	
+	redef record Reducer += {
+		## A number of sample DataPoints to collect.
+		samples: count &default=0;
+	};
+
+	redef record Result += {
+		## A sample of something being measured.  This is helpful in 
+		## some cases for collecting information to do further detection
+		## or better logging for forensic purposes.
+		samples: vector of Measurement::DataPoint &optional;
+	};
+}
+
+redef record Result += {
+	# Internal use only.  This is the queue where samples
+	# are maintained since the queue is self managing for
+	# the number of samples requested.
+	sample_queue: Queue::Queue &optional;
+};
+
+hook add_to_reducer(r: Reducer, val: double, data: DataPoint, result: Result)
+	{
+	if ( r$samples > 0 )
+		{
+		if ( ! result?$sample_queue )
+			result$sample_queue = Queue::init([$max_len=r$samples]);
+		Queue::push(result$sample_queue, data$str);
+		}
+	}
+
+hook compose_resultvals_hook(result: Result, rv1: Result, rv2: Result)
+	{
+	# Merge $sample_queue
+	if ( rv1?$sample_queue && rv2?$sample_queue )
+		result$sample_queue = Queue::merge(rv1$sample_queue, rv2$sample_queue);
+	else if ( rv1?$sample_queue )
+		result$sample_queue = rv1$sample_queue;
+	else if ( rv2?$sample_queue )
+		result$sample_queue = rv2$sample_queue;
+	}