possible bug in how limits are applied with sorting
djw1149 opened this issue · 1 comments
As observed by Nate Meyer: Sorting with a limit fetches default amount of rows, sorts, then applies the specified limit.
$ dnsdbq -S -k last -n ns5.dnsmadeeasy.com -l 1000000 -t ns
will not return enough answers; instead it will return dnstli's configured default limit, normally 10K, instead of the 1M rows requested.
There is a strong benefit with the current behavior since it is closer to what the user might want.
Two possible changes:
- Apply the -l limit in the dnsdb query, then sort.
- Do # 1 plus add a new option, -L, which is a limit to apply post-sorting.
If JSON format results are desired, then change # 2 could be done using a head or tail command on the output from change # 1.
Sorting with jq is possible too:
$ dnsdbq -l xxx -j .... | jq -s 'sort_by((.zone_time_first,.zone_time_last) ? // (.time_first,.time_last))'
will use jq to sort, after limit is applied. Or can do 'sort_by(.count)' for sort by count.
But I have not figured out one problem with it: the results using the jq -s option come out inside an array:
$ dnsdbq -l 1 -j -n farsightsecurity.com | jq -s 'sort_by((.zone_time_first,.zone_time_last) ? // (.time_first,.time_last))'
[
{
"count": 7,
"time_first": 1380044973,
"time_last": 1380141734,
"rrname": "207.4.20.149.in-addr.fsi.io.",
"rrtype": "PTR",
"rdata": "farsightsecurity.com."
}
]
If I can remove, preferably using jq, the array notation, then this output could be fed back into dnsdbq with the -J option to output non-JSON formats.
fix was accepted.