From: Robert Klemme <shortcutter@...>
Date: 2012-07-10T00:41:18+09:00
Subject: Re: Troubled while trying to create list from hash

On Sun, Jul 8, 2012 at 10:52 PM, Panagiotis Atmatzidis
<ml@convalesco.org> wrote:
> puts @data_table returns lines like this: "2012-05-21 09:51:21 [ssh-iptables] 222.177.23.129 CN China"
>
> So the ip is referred in the source code as "[entry.split(' ')[3]]" ... which returns the 4th parameter (if you start counting by 1 the 3rd if you count in ruby way).

split will break if there can be whitespace between [] (where you have
"ssh-iptables").  I'd rather match IP addresses.

> There are some "duplicate IP's" which I want to enumerate. There are two IP's that appear 7 times. I want o add these into a secondary list in order to display them later on in another function.

Here's an alternative solution - a tad more involved.

def top_ips
  count = Hash.new 0
  max = 0

  @data_table.each do |line|
    ip = line[/\d{1,3}(?:\.\d{1,3}){3}/] and max=[max, count[ip] += 1].max
  end

  count.select {|ip, c| c == max}.map {|ip, c| ip}
end

OR

def top_ips
  count = Hash.new 0
  max = 0

  @data_table.each do |line|
    ip = line[/\d{1,3}(?:\.\d{1,3}){3}/] and (count[ip] += 1).tap {|c|
max = c if c > max}
  end

  count.select {|ip, c| c == max}.map {|ip, c| ip}
end

The idea is to match IP adresses properly, calculate the max along the
way and finally select only those pairs where count == max.

Kind regards

robert

-- 
remember.guy do |as, often| as.you_can - without end
http://blog.rubybestpractices.com/