Help Count problem

vs_shankar2000 · December 7th, 2004, 02:46 PM

hello everybody!
i want count node(Severity)value According to count node(Symptom).
this is table header
<th>TotalMessage</th>
<th>Critical</th>
<th>Suspicious</th>
<th>Relevant</th>
<th>Interesting</th>
but i got out only count node(Symptom).
1 DDOS Stacheldraht client check gag
1 named-probe-authors: Snort IDS480
.. like that

please help me
shankar

<?xml version="1.0" encoding="UTF-8"?>
<CSVToXML>
    <RECORD>
        <Ticketid>DC2000000708378</Ticketid>
        <Status/>
        <Severity>Relevant</Severity>
        <Symptom>DDOS Stacheldraht client check gag</Symptom>
        <Sentryid>trii-001</Sentryid>
        <GatewayMessages>2</GatewayMessages>
    </RECORD>
    <RECORD>
        <Ticketid>DC2000000708383</Ticketid>
        <Status>Resolved</Status>
        <Severity>Relevant</Severity>
        <Symptom>named-probe-authors: Snort IDS480</Symptom>
        <Sentryid>trii-001</Sentryid>
        <GatewayMessages>3</GatewayMessages>
    </RECORD>
    <RECORD>
        <Ticketid>DC2000000708384</Ticketid>
        <Status>Resolved</Status>
        <Severity>Relevant</Severity>
        <Symptom>dns_named-probe-version: Snort</Symptom>
        <Sentryid>trii-001</Sentryid>
        <GatewayMessages>2</GatewayMessages>
    </RECORD>
    <RECORD>
        <Ticketid>DC2000000708389</Ticketid>
        <Status>Resolved</Status>
        <Severity>Relevant</Severity>
        <Symptom>WEB-MISC /etc/passwd: Snort</Symptom>
        <Sentryid>trii-001</Sentryid>
        <GatewayMessages>178</GatewayMessages>
    </RECORD>
    <RECORD>
        <Ticketid>DC2000000708390</Ticketid>
        <Status>Resolved</Status>
        <Severity>Relevant</Severity>
        <Symptom>web-cgi_http-cgi-test-cgi: Snort</Symptom>
        <Sentryid>trii-001</Sentryid>
        <GatewayMessages>4</GatewayMessages>
    </RECORD>
</CSVToXML>

my xslt is
<?xml version="1.0"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">

<xsl:key name="MessageKy" match="RECORD" use="Symptom" />

<xsl:template match="CSVToXML">

  <table>
  <xsl:for-each select="RECORD[generate-id(.) = generate-id(key('MessageKy', Symptom)[1])]">

   <xsl:sort data-type="number" order="descending" select="count(key('MessageKy',Symptom))"/>
      <tr>
        <td><xsl:value-of select="count(key('MessageKy',Symptom))"/></td>
        <td><xsl:value-of select="Symptom"/></td>
      </tr>
    </xsl:for-each>
   </table>
  </xsl:template>

</xsl:stylesheet>

output html like that
1 DDOS Stacheldraht client check gag
1 named-probe-authors: Snort IDS480
1 dns_named-probe-version: Snort
...
..

Shankar sam
India

jkmyoung · December 7th, 2004, 03:12 PM

<td><xsl:value-of select="count(key('MessageKy',Symptom))"/></td>
<td><xsl:value-of select="count(key('MessageKy',Symptom)[Severity='Critical'])"/></td>
<td><xsl:value-of select="count(key('MessageKy',Symptom)[Severity='Suspicious'])"/></td>
<td><xsl:value-of select="count(key('MessageKy',Symptom)[Severity='Relevant'])"/></td>
<td><xsl:value-of select="count(key('MessageKy',Symptom)[Severity='Interesting'])"/></td>
<td><xsl:value-of select="Symptom"/></td>

There may be a better way, depending on how you want your output. Also, if your severity text changes, it'd be better not to hardcode it.

vs_shankar2000 · December 8th, 2004, 08:46 AM

Hi
thanks for your replay. it's more helpful for me, one more question
how to get top 10 value from count Symptom node
<table>
            <xsl:for-each select="RECORD[generate-id(.) = generate-id(key('MessageKy', Symptom)[1])]">
                <xsl:sort data-type="number" order="descending" select="count(key('MessageKy',Symptom))"/>
                <tr>
                    <td>
                        <xsl:value-of select="count(key('MessageKy',Symptom))"/>
                    </td>
                    <td>
                        <xsl:value-of select="count(key('MessageKy',Symptom)[Severity='Critical'])"/>
                    </td>
                    <td>
                        <xsl:value-of select="count(key('MessageKy',Symptom)[Severity='Suspicious'])"/>
                    </td>
                    <td>
                        <xsl:value-of select="count(key('MessageKy',Symptom)[Severity='Relevant'])"/>
                    </td>
                    <td>
                        <xsl:value-of select="count(key('MessageKy',Symptom)[Severity='Interesting'])"/>
                    </td>
                    <td>
                        <xsl:value-of select="count(key('MessageKy',GatewayMessages))"/>
                    </td>
                    <td>
                        <xsl:value-of select="Symptom"/>
                    </td>
                </tr>
            </xsl:for-each>
        </table>
it 's more helpful for me

Shankar sam
India

jkmyoung · December 8th, 2004, 07:57 PM

Do you mean only display the first ten rows?

Code:

<table>
  <xsl:for-each select="RECORD[generate-id(.) = generate-id(key('MessageKy', Symptom)[1])]">
    <xsl:sort data-type="number" order="descending" select="count(key('MessageKy',Symptom))"/>
      <xsl:if test="position() &lt;= 10>
        <tr>.....

vs_shankar2000 · December 9th, 2004, 07:29 AM

thanks for repalyed.
when use it <xsl:value-of select="sum(key('MessageKy',GatewayMessages))" />
i got value 0 only
thanking you

<?xml version="1.0"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
    <xsl:key name="MessageKy" match="RECORD" use="Symptom"/>
    <xsl:template match="CSVToXML">
        <table border=".5" bordercolor="#000000">
            <th bgcolor="#3366CC">
                <b>Total</b>
            </th>
            <th bgcolor="#3366CC">
                <b>0 Critical</b>
            </th>
            <th bgcolor="#3366CC">
                <b>1 Suspicious</b>
            </th>
            <th bgcolor="#3366CC">
                <b>2 Relevant</b>
            </th>
            <th bgcolor="#3366CC">
                <b>Possible Tuning</b>
            </th>
            <th bgcolor="#3366CC">
                <b>Message Name</b>
            </th>
            <th bgcolor="#3366CC">
                <b>GWMs</b>
            </th>
            <xsl:for-each select="RECORD[generate-id(.) = generate-id(key('MessageKy', Symptom)[1])]">
                <xsl:sort data-type="number" order="descending" select="count(key('MessageKy',Symptom))"/>
                <xsl:if test="position() <= 10">
                    <tr>
                        <td>
                            <xsl:value-of select="count(key('MessageKy',Symptom))"/>
                        </td>
                        <td>
                            <xsl:value-of select="count(key('MessageKy',Symptom)[Severity='Critical'])"/>
                        </td>
                        <td>
                            <xsl:value-of select="count(key('MessageKy',Symptom)[Severity='Suspicious'])"/>
                        </td>
                        <td>
                            <xsl:value-of select="count(key('MessageKy',Symptom)[Severity='Relevant'])"/>
                        </td>
                        <td/>
                        <td>
                            <xsl:value-of select="Symptom"/>
                        </td>
                        <td>
                            <xsl:value-of select="sum(key('MessageKy',GatewayMessages))" />
                        </td>
                    </tr>
                </xsl:if>
            </xsl:for-each>
        </table>
    </xsl:template>
</xsl:stylesheet>

Shankar sam
India