Loading ...
Sorry, an error occurred while loading the content.

Re: [PBML] Hashing/ Wrong output!!!!

Expand Messages
  • Charles K. Clarkson
    ... [snipped code] ... Could you just show what you want the output to look like instead? I really don t follow what your asking for. Charles K. Clarkson And
    Message 1 of 4 , Jun 1, 2001
    • 0 Attachment
      Portia <portia317@...> asked:

      : I need help with hashes- I have this piece of code:
      :
      [snipped code]
      : My output looks like this:
      :
      : SOURCE IP = 192.101 total hits are 2
      : LOG SOURCE = Meade
      : SOURCE IP = 192.100 total hits are 1
      : LOG SOURCE = Monmouth
      : SOURCE IP = 192.102 total hits are 1
      : LOG SOURCE = Yuma
      : SOURCE IP = 192.103 total hits are 1
      : LOG SOURCE = Monmouth
      :
      : My data file looks like this:
      :
      : Monmouth,2000-05-20 00:00:09-04,192.100
      : Jackson,2000-04-21 00:00:10-05,192.101
      : Meade, 2001-01-05 00:00:11-04,192.101
      : Yuma, 200-03-11 00:00:12-05,192.102
      : Monmouth,200-04-10 00:00:10-08,192.103
      :
      : I need to print out multiple log source's for a
      : source_ip. I think it has to do with the
      : relationship of the source ip to log source.
      : There is one source ip but many log sources.
      : Then i need to count how many times each log
      : source was hit by that source ip.
      :

      Could you just show what you want the output
      to look like instead? I really don't follow what
      your asking for.

      Charles K. Clarkson

      And he puzzled three hours, till his puzzler was sore.
      Then the Grinch thought of something he hadn't before!
      - Dr. Seuss
    • portia317@yahoo.com
      ... Sorry- this is what I want it to look like: SOURCE IP = 192.101 total hits are 2 LOG SOURCE = Meade (1), Jackson (1) //I m not getting Jackson? SOURCE
      Message 2 of 4 , Jun 4, 2001
      • 0 Attachment
        --- In perl-beginner@y..., "Charles K. Clarkson" <c_clarkson@h...>
        wrote:
        > Portia <portia317@y...> asked:
        >
        > : I need help with hashes- I have this piece of code:
        > :
        > [snipped code]
        > : My output looks like this:
        > :
        > : SOURCE IP = 192.101 total hits are 2
        > : LOG SOURCE = Meade
        > : SOURCE IP = 192.100 total hits are 1
        > : LOG SOURCE = Monmouth
        > : SOURCE IP = 192.102 total hits are 1
        > : LOG SOURCE = Yuma
        > : SOURCE IP = 192.103 total hits are 1
        > : LOG SOURCE = Monmouth
        > :
        > : My data file looks like this:
        > :
        > : Monmouth,2000-05-20 00:00:09-04,192.100
        > : Jackson,2000-04-21 00:00:10-05,192.101
        > : Meade, 2001-01-05 00:00:11-04,192.101
        > : Yuma, 200-03-11 00:00:12-05,192.102
        > : Monmouth,200-04-10 00:00:10-08,192.103
        > :
        > : I need to print out multiple log source's for a
        > : source_ip. I think it has to do with the
        > : relationship of the source ip to log source.
        > : There is one source ip but many log sources.
        > : Then i need to count how many times each log
        > : source was hit by that source ip.
        > :
        >
        > Could you just show what you want the output
        > to look like instead? I really don't follow what
        > your asking for.
        >
        > Charles K. Clarkson
        Sorry- this is what I want it to look like:

        SOURCE IP = 192.101 total hits are 2
        LOG SOURCE = Meade (1), Jackson (1) //I'm not getting Jackson?
        SOURCE IP = 192.100 total hits are 1
        LOG SOURCE = Monmouth
        SOURCE IP = 192.102 total hits are 1
        LOG SOURCE = Yuma
        SOURCE IP = 192.103 total hits are 1
        LOG SOURCE = Monmouth

        Also, how can I get the number of hits to the log source by the
        source ip? Thanks for your help again!
        Porshe
      • Charles K. Clarkson
        ... Well, I changed the data structure to accommodate the log source counts: Previous structure: { 192.100 = Monmouth , 192.101 = Meade , 192.102 =
        Message 3 of 4 , Jun 4, 2001
        • 0 Attachment
          Porshe <portia317@...> writes:

          : Sorry- this is what I want it to look like:
          :
          : SOURCE IP = 192.101 total hits are 2
          : LOG SOURCE = Meade (1), Jackson (1) //I'm not getting Jackson?
          : SOURCE IP = 192.100 total hits are 1
          : LOG SOURCE = Monmouth
          : SOURCE IP = 192.102 total hits are 1
          : LOG SOURCE = Yuma
          : SOURCE IP = 192.103 total hits are 1
          : LOG SOURCE = Monmouth
          :
          : Also, how can I get the number of hits to the log
          : source by the source ip? Thanks for your help again!

          Well, I changed the data structure to accommodate
          the log source counts:

          Previous structure:
          {
          '192.100' => 'Monmouth',
          '192.101' => 'Meade',
          '192.102' => 'Yuma',
          '192.103' => 'Monmouth'
          }

          New structure:
          {
          '192.100' => {'Monmouth' => '1'},
          '192.101' => {'Jackson' => '1',
          'Meade' => '1'},
          '192.102' => {'Yuma' => '1'},
          '192.103' => {'Monmouth' => '1'}
          }

          The new structure adds an anonymous hash for
          each of the previous structure's values. Each
          new hash keeps a count by log source. See
          perldsc for an introduction to hash of hashes
          (HoH) structures.

          Since perl will autovivify the hash, this
          change in structure was easy to implement.

          In the for loop:
          $loger{$source_ip} = $log_source;

          becomes:
          $loger{$source_ip}{$log_source}++;

          Getting to the data in the new structure
          is a bit more complicated now. To get the
          formatted look of 'Meade (1), Jackson (1)'.
          let's change the inner hashes to a formatted
          array. Then we can use 'join' to print it.

          from:
          'Jackson' => '1', 'Meade' => '1'}

          to:
          'Meade (1)', 'Jackson (1)'

          How do we access the inner hashes though?
          [Glad you asked]

          In the previous structure we could access
          an individual value in %loger with
          $loger{192.101}. Since these are now
          references to a hash, we refer to that hash
          with:

          %{ $loger{192.101} }

          To get it's keys and values, we 'each':

          while (my ($key, $value) = each %{ $loger{192.101} } ) {

          To find out how many hashes are in
          $loger{192.101}, we use:

          scalar keys %{ $loger{192.101} }

          or in our case:

          $count_ip{192.101} will do.

          So to get a formatted look we need
          something like:

          foreach (@sorted_highest_to_lowest) {
          my @formatted;
          while (my ($source, $hits) = each %{$loger{$_}}) {
          push @formatted, "$source($hits)";
          }
          print join ', ', @formatted;
          print "\n";
          }

          which prints:

          Jackson(1), Meade(1)
          Monmouth(1)
          Yuma(1)
          Monmouth(1)

          But, we didn't want the formatted look
          for the single counts so we'll add code for
          that:

          if ($count_ip{$_} == 1) {
          print 'LOG SOURCE = ', keys %{$loger{$_}}, "\n";
          next;
          }

          Since there is only one log source there
          is only one key. For the multple log sources:

          print 'LOG SOURCE = ';
          my @formatted;
          while (my ($source, $hits) = each %{$loger{$_}}) {
          push @formatted, "$source($hits)";
          }
          print join ', ', @formatted;
          print "\n";


          HTH,
          Charles K. Clarkson

          I'd be curious to see the whole program
          when you're done.



          my %sourceip;
          my %countsip;
          my %countlogs;
          my %count_logs;
          my %count_ip;
          my %loger;
          my %logsrc;

          foreach (@data) {
          my ($log_source, $time_stamp, $source_ip) = split /,/;

          $sourceip{$source_ip} = $source_ip;
          $countsip{$source_ip}++;
          $count_ip{$source_ip} = $countsip{$source_ip};

          $logsrc{$log_source} = $log_source;
          $loger{$source_ip}{$log_source}++;
          }

          my @sorted_highest_to_lowest =
          sort {$count_ip{$b} <=> $count_ip{$a} }
          keys %count_ip;

          foreach (@sorted_highest_to_lowest) {
          print "SOURCE IP = $sourceip{$_} total hits are $count_ip{$_}\n";
          if ($count_ip{$_} == 1) {
          print 'LOG SOURCE = ', keys %{$loger{$_}}, "\n";
          next;
          }

          print 'LOG SOURCE = ';
          my @formatted;
          while (my ($source, $hits) = each %{$loger{$_}}) {
          push @formatted, "$source($hits)";
          }
          print join ', ', @formatted;
          print "\n";
          }

          __END__
        • portia317@yahoo.com
          Thanks Charles- you re the best :)
          Message 4 of 4 , Jun 5, 2001
          • 0 Attachment
            Thanks Charles- you're the best :)
          Your message has been successfully submitted and would be delivered to recipients shortly.