diff --git a/scripts/base/frameworks/measurement/plugins/hll_unique.bro b/scripts/base/frameworks/measurement/plugins/hll_unique.bro index 0e95e6fcdd..ccdb872606 100644 --- a/scripts/base/frameworks/measurement/plugins/hll_unique.bro +++ b/scripts/base/frameworks/measurement/plugins/hll_unique.bro @@ -10,14 +10,23 @@ export { redef record ResultVal += { ## If cardinality is being tracked, the number of unique ## items is tracked here. - hllunique: opaque of cardinality &default=hll_cardinality_init(0.01); + hllunique: count &default=0; }; } +redef record ResultVal += { + # Internal use only. This is not meant to be publically available + # because probabilistic data structures have to be examined using + # specialized bifs. + card: opaque of cardinality &default=hll_cardinality_init(0.01); +}; + + hook init_resultval_hook(r: Reducer, rv: ResultVal) { - if ( HLLUNIQUE in r$apply && ! rv?$hllunique ) - rv$hllunique = hll_cardinality_init(0.01); + if ( HLLUNIQUE in r$apply && ! rv?$card ) + rv$card = hll_cardinality_init(0.01); + rv$hllunique = 0; } @@ -25,15 +34,17 @@ hook add_to_reducer_hook(r: Reducer, val: double, data: DataPoint, rv: ResultVal { if ( HLLUNIQUE in r$apply ) { - hll_cardinality_add(rv$hllunique, data); + hll_cardinality_add(rv$card, data); + rv$hllunique = double_to_count(hll_cardinality_estimate(rv$card)); } } hook compose_resultvals_hook(result: ResultVal, rv1: ResultVal, rv2: ResultVal) { local rhll = hll_cardinality_init(0.01); - hll_cardinality_merge_into(rhll, rv1$hllunique); - hll_cardinality_merge_into(rhll, rv2$hllunique); + hll_cardinality_merge_into(rhll, rv1$card); + hll_cardinality_merge_into(rhll, rv2$card); - result$hllunique = rhll; + result$card = rhll; + result$hllunique = double_to_count(hll_cardinality_estimate(rhll)); } diff --git a/testing/btest/scripts/base/frameworks/measurement/basic.bro b/testing/btest/scripts/base/frameworks/measurement/basic.bro index 4706a7c9b1..701b79fbb3 100644 --- a/testing/btest/scripts/base/frameworks/measurement/basic.bro +++ b/testing/btest/scripts/base/frameworks/measurement/basic.bro @@ -19,7 +19,7 @@ event bro_init() &priority=5 for ( key in data ) { local r = data[key]["test.metric"]; - print fmt("Host: %s - num:%d - sum:%.1f - var:%.1f - avg:%.1f - max:%.1f - min:%.1f - std_dev:%.1f - unique:%d - hllunique:%.1f", key$host, r$num, r$sum, r$variance, r$average, r$max, r$min, r$std_dev, r$unique, hll_cardinality_estimate(r$hllunique)); + print fmt("Host: %s - num:%d - sum:%.1f - var:%.1f - avg:%.1f - max:%.1f - min:%.1f - std_dev:%.1f - unique:%d - hllunique:%d", key$host, r$num, r$sum, r$variance, r$average, r$max, r$min, r$std_dev, r$unique, r$hllunique); } } ]);