Skip to content

Instantly share code, notes, and snippets.

@ers81239

ers81239/gist:1994230

Created March 7, 2012 16:34
Show Gist options
  • Save ers81239/1994230 to your computer and use it in GitHub Desktop.
Save ers81239/1994230 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gistfile1.txt
Mar 7 16:28:10 leatherface SFTop10Cacher[13870]: [SQL][1][QueryEngine.pm:862]
Mar 7 16:28:10 leatherface SFTop10Cacher[13870]: SELECT COUNT(*), t13870_event.classification
Mar 7 16:28:10 leatherface SFTop10Cacher[13870]: FROM event_1329145200 t13870_event
Mar 7 16:28:10 leatherface SFTop10Cacher[13870]: LEFT JOIN rna_ip_host AS t13870_rna_ip_host
Mar 7 16:28:10 leatherface SFTop10Cacher[13870]: ON (t13870_event.ip_dst = t13870_rna_ip_host.ipaddr)
Mar 7 16:28:10 leatherface SFTop10Cacher[13870]: LEFT JOIN rna_ip_host_reported_by_sensor AS t13870_rna_ip_host_reported_by_sensor
Mar 7 16:28:10 leatherface SFTop10Cacher[13870]: ON (t13870_event.ip_dst = t13870_rna_ip_host_reported_by_sensor.ipaddr AND t13870_rna_ip_host_reported_by_sensor.secondary = 0)
Mar 7 16:28:10 leatherface SFTop10Cacher[13870]: WHERE (t13870_rna_ip_host.criticality = '3' AND t13870_event.classification IS NOT NULL) AND tv_sec >= 1331134090 AND tv_sec < 1331137690
Mar 7 16:28:10 leatherface SFTop10Cacher[13870]: GROUP BY t13870_event.classification
Mar 7 16:28:10 leatherface SFTop10Cacher[13870]: HAVING (COUNT(*) != '0')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment