window.top_sums

Supported in:

Rules Search

window.top_sums(strings, weights, how_many_to_retrieve)

Description

Return the specified number of most common strings and corresponding weight in the input values in string:weight format. Default values are not ignored.

Param data types

STRING, INT, INT

Return type

ARRAY_STRINGS

Code samples

Example 1

This example shows the top two window sizes.

events:
 $e.user.userid = $userid
match:
 $userid over 5m
outcome:
  $p1 = window.top_sums($e.principal.hostname, $e.file.size, 2) // yields ["a:100", "c:20"] if the event hostname values in the match window are ["a", "b", "b", "c"] and file sizes are [100, 5, 10, 20].
condition:
  $e and arrays.contains($p1, "apple")

Example 2

This example shows handling when window size is more than array size.

events:
 $e.user.userid = $userid
match:
 $userid over 5m
outcome:
  $p1 = window.top_sums($e.principal.hostname, $e.file.size, 100) // yields ["a:100", "c:20", "b:15"] if the event hostname values in the match window are ["a", "b", "b", "c"] and file sizes are [100, 5, 10, 20].
condition:
  $e and arrays.contains($p1, "apple")

Example 3

This example shows handling when some input strings have same weight.

events:
 $e.user.userid = $userid
match:
 $userid over 5m
outcome:
  $p1 = window.top_sums($e.principal.hostname, $e.file.size, 3) // yields ["a:20", "c:20", "b:15"] if the event hostname values in the match window are ["a", "b", "b", "c"] and file sizes are [20, 5, 10, 20].
condition:
  $e and arrays.contains($p1, "apple")

Example 4

This example shows handling when some input strings have zero weight.

events:
 $e.user.userid = $userid
match:
 $userid over 5m
outcome:
  $p1 = window.top_sums($e.principal.hostname, $e.file.size, 3) // yields ["c:21", "a:20"] if the event hostname values in the match window are ["a", "b", "b", "c"] and file sizes are [20, 0, 0, 21].
condition:
  $e and arrays.contains($p1, "apple")