[yaala] Differences between Classic and Combined

[Florian Forster]

--vmttodhTwj0NAgWp
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi :)

On Wed, May 07, 2003 at 01:16:55PM +0200, Federico Lombardo wrote:
> Florian, sorry for the stupid question but, which are the real differences
> from Classic and Combined output ?

The Classic output was the output yaala used up to 0.4.2 and it was
pretty much "the idea" I had when I began to write yaala: Basicly it
combined any two fields. So the first step is that there is one page for
every key. Lets assume you select the fields date, hour and client (as
it is in the sample on the homepage). So there's one page for all
date-values, one for all hour-values, etc.
On each page, the values are printed in tables. For the hour-field this
would be the '00' through '23'. In each table, each (other) field (than
the one the entire page is about) and all their values are printed.
This makes it very easy to check, for example, which client had the most
requests at between 3:00am and 3:59am: You go to the 'hour' page, go to
the table '03' and look at the lines labeled 'client' on the left.

So this output combines the fields selected in any combination. There
are a lot of combinations that don't make sense (let's say "Top level
Domains" and "MIME Types"..), but it might be fun anyways. The downside
is, that the amount of information grows with the number of fields _and_
the number of values for each field. (The number of field-combinations is
"n^2 - n" with n being the number of fields. So it grows expotentially.)

The Combined output got sent to me by qMax together with more flexible
selections (up to then you could just make a do/don't decision for each
field). It features two different types of tables:
One dimensional tables are very simple and much like a top10 (top20,
topX, ..) list: You have a field (e.g. "hour") and print one value
("00", "01", ..) in each line together with the aggregation-value
(number of requests, total of bytes..).
Two dimensional tables also combine two fields: One fields has one line
perl value, the other has one column perl value. In the cell at the
intersection you find the aggregation-value for both values (e.g. bytes
at 3:00 (till 3:59) on 2003-05-07).

By combining a one-dimensional and a two-dimensional table you can even
combine three fields. So although you can select "only" three fields
with the Combined output, you can actually combine more fields than with
the classic output. The classic output doesn't combine all the fields
you select at once, but combines any two fields.

Ok, I hope this helped clearify this a little.. If you still have any
questions don't hestitate to ask :)

Regards,
-octo

--=20
Florian octo Forster
Hacker in training
GnuPG: 0x91523C3D
http://verplant.org/

--vmttodhTwj0NAgWp
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+uPbejvke9ZFSPD0RApwyAJoD8XBqcoziyrp88cSk7B9+VTDw/ACePD6P
oLYtI4IfFyRtFEzrmp2clQU=
=C/xF
-----END PGP SIGNATURE-----

--vmttodhTwj0NAgWp--