Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 09:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge branch 'topic/bernhard/hyperloglog-with-measurement' into topic/bernhard/hyperloglog

Browse source
This commit is contained in:
Bernhard Amann 2013-04-25 13:46:36 -07:00
commit 9802e2332d
6 changed files with 65 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

3
scripts/base/frameworks/sumstats/plugins/__load__.bro
View file

@ -1,8 +1,9 @@
@load ./average
@load ./hll_unique
@load ./max
@load ./min
@load ./sample
@load ./std-dev
@load ./sum
@load ./unique
@load ./variance
@load ./variance

51
scripts/base/frameworks/sumstats/plugins/hll_unique.bro Normal file
View file

@ -0,0 +1,51 @@
@load base/frameworks/sumstats
module SumStats;
export {
redef enum Calculation += {
## Calculate the number of unique values.
HLLUNIQUE
};
redef record ResultVal += {
## If cardinality is being tracked, the number of unique
## items is tracked here.
hllunique: count &default=0;
};
}
redef record ResultVal += {
# Internal use only. This is not meant to be publically available
# because probabilistic data structures have to be examined using
# specialized bifs.
card: opaque of cardinality &default=hll_cardinality_init(0.01);
};
hook init_resultval_hook(r: Reducer, rv: ResultVal)
{
if ( HLLUNIQUE in r$apply && ! rv?$card )
rv$card = hll_cardinality_init(0.01);
rv$hllunique = 0;
}
hook observe_hook(r: Reducer, val: double, obs: Observation, rv: ResultVal)
{
if ( HLLUNIQUE in r$apply )
{
hll_cardinality_add(rv$card, obs);
rv$hllunique = double_to_count(hll_cardinality_estimate(rv$card));
}
}
hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal)
{
local rhll = hll_cardinality_init(0.01);
hll_cardinality_merge_into(rhll, rv1$card);
hll_cardinality_merge_into(rhll, rv2$card);
result$card = rhll;
result$hllunique = double_to_count(hll_cardinality_estimate(rhll));
}