Comments on: Event Processing – Normalization http://raffy.ch/blog/2007/08/25/event-processing-normalization/ Log visualization and log management as seen by Raffael Marty Thu, 26 Jan 2012 07:17:42 +0000 hourly 1 http://wordpress.org/?v=3.2.1 By: Raffy’s Computer Security Blog » My Splunk Blog http://raffy.ch/blog/2007/08/25/event-processing-normalization/comment-page-1/#comment-9971 Raffy’s Computer Security Blog » My Splunk Blog Tue, 04 Dec 2007 00:02:55 +0000 http://raffy.ch/blog/2007/08/25/event-processing-normalization/#comment-9971 [...] post things that are relevant to my employment and Splunk on my Splunk blog. I will continue my rant on normalization and SIEM over [...] [...] post things that are relevant to my employment and Splunk on my Splunk blog. I will continue my rant on normalization and SIEM over [...]

]]> By: Raffy » Blog Archive » Raffael Marty aka Raffy http://raffy.ch/blog/2007/08/25/event-processing-normalization/comment-page-1/#comment-7763 Raffy » Blog Archive » Raffael Marty aka Raffy Wed, 12 Sep 2007 15:33:08 +0000 http://raffy.ch/blog/2007/08/25/event-processing-normalization/#comment-7763 [...] topic in some future blog posts. On my personal blog I already started to outline the problem of normalization, which is probably the biggest and most important diffference. I will roll the topic up again right [...] [...] topic in some future blog posts. On my personal blog I already started to outline the problem of normalization, which is probably the biggest and most important diffference. I will roll the topic up again right [...]

]]> By: Raffael Marty http://raffy.ch/blog/2007/08/25/event-processing-normalization/comment-page-1/#comment-7363 Raffael Marty Tue, 28 Aug 2007 19:21:54 +0000 http://raffy.ch/blog/2007/08/25/event-processing-normalization/#comment-7363 Well, I guess you are taking the discussion into a slightly different area than I started it. What strikes me is the parallels you can draw between the two interpretations of my blog post... Let me address where we think differently first: You are talking about database normalizations. What I was talking about is event normalization or parsing. Although related, the two topics are fairly different. In order to store the parsed data, you would use some sort of database (normally) and use indexes and normalized database tables, etc. I leave those discussions to the database developers. But when it comes to parsing data and normalizing events, I will chime in again ;) So, the parallels. Normalization in either world adds complexity. A fair amount of it. Interesting. I haven't thought of this before... Well, I guess you are taking the discussion into a slightly different area than I started it. What strikes me is the parallels you can draw between the two interpretations of my blog post… Let me address where we think differently first:

You are talking about database normalizations. What I was talking about is event normalization or parsing. Although related, the two topics are fairly different. In order to store the parsed data, you would use some sort of database (normally) and use indexes and normalized database tables, etc. I leave those discussions to the database developers. But when it comes to parsing data and normalizing events, I will chime in again ;)

So, the parallels. Normalization in either world adds complexity. A fair amount of it. Interesting. I haven’t thought of this before…

]]> By: TK http://raffy.ch/blog/2007/08/25/event-processing-normalization/comment-page-1/#comment-7355 TK Tue, 28 Aug 2007 03:21:19 +0000 http://raffy.ch/blog/2007/08/25/event-processing-normalization/#comment-7355 Awesome topic and thanks for bringing it up. The plan that gets to your destination is not always the same plan you need to move to your next for sure. Let me offer a set of URLs that readers might find interesting. http://www.realsoftwaredevelopment.com/2007/08/to-normalize-or.html http://blogs.msdn.com/pathelland/archive/2007/07/23/normalization-is-for-sissies.aspx Heck, just google 'normalization' and go from there. :-) Unless you are willing to think beyond the RDBS mindset, please don't argue the point. --tk Awesome topic and thanks for bringing it up. The plan that gets to your destination is not always the same plan you need to move to your next for sure. Let me offer a set of URLs that readers might find interesting.

http://www.realsoftwaredevelopment.com/2007/08/to-normalize-or.html

http://blogs.msdn.com/pathelland/archive/2007/07/23/normalization-is-for-sissies.aspx

Heck, just google ‘normalization’ and go from there. :-)

Unless you are willing to think beyond the RDBS mindset, please don’t argue the point.

–tk

]]>