how to loop endlessly

[denmatias]

Hi,

How to loop like this

Event fields

field1 [value1a, value1b, value1c, value1d,...]
field2 [value2a, value2b, value2c, value2d....]
field3 [value3a, value3b, value3c, value3d....]
and so on..

---

---------------------------------
| value1a  | value2a  | value3a  |
|          |          ------------
|      |          | value3b  |
|          |          -----------
|      |          | value3c  |
|          -----------------------
|          | value2b  | value3a  |
|          |          ------------
|      |          | value3b  |
|          |          ------------
|      |          | value3c  |
|          |----------------------
|          | value2c  | value3c  |
|          |          ------------
|      |          | value3b  |
|          |          ------------
|      |          | value3c  |
---------------------------------- 
| value1b  | value2a  | value3a  |
|          |          ------------
|      |          | value3b  |
|          |          -----------
|      |          | value3c  |
|          -----------------------
|          | value2b  | value3a  |
|          |          ------------
|      |          | value3b  |
|          |          ------------
|      |          | value3c  |
|          |----------------------
|          | value2c  | value3c  |
|          |          ------------
|      |          | value3b  |
|          |          ------------
|      |          | value3c  |
----------------------------------

[denmatias]

---

The requirement is for IDP traffic

field1 = source ip addresses (external and internal)
field2 = destination ip addresses (external and internal)
field3 = severity
field4 = attack signature

I want to group the row by source ip
then each row I want to group by destination ip
then each row of destination, I want to group by severity count
then from severity row, i want to group by attack signature

this is for report, dashboard and alert.

Example

---

 ------------------------------------------------------------------------------------------------
|  SRC_IP    |  DEST IP  |  SEV HIGH | SEV CRIT |  ATTACT COUNT | ATTACK SIGNATURE | And so on...|
|------------|-----------|-----------|----------|---------------|------------------|-------------|
|  1.2.3.4   |  4.3.2.1  |      5    |          |     2         |       BLAH1      |             |
|            |           |           |          |     3         |       BLAH5      |   etc...    |
|            |           |           |          |     1         |       BLAH7      |             |
|            |           |-----------|----------|---------------|------------------|-------------|
|            |           |           |   4      |     2         |       BLAH2      |             |
|            |           |           |          |     1         |       BLAH5      |    etc...   |
|            |           |           |          |     1         |       BLAH1      |             |
|            |-----------|-----------|----------|---------------|------------------|-------------|
|            |  3.6.2.9  |      3    |          |     1         |       BLAH6      |             |
|            |           |           |          |     1         |       BLAH8      |   etc...    |
|            |           |           |          |     1         |       BLAH7      |             |
|            |           |-----------|----------|---------------|------------------|-------------|
|            |           |           |   6      |     2         |       BLAH3      |             |
|            |           |           |          |     2         |       BLAH5      |    etc...   |
|            |           |           |          |     2         |       BLAH1      |             |
|            |-----------|-----------|----------|---------------|------------------|-------------|
|            |  3.6.2.9  |      3    |          |     1         |       BLAH6      |             |
|            |           |           |          |     1         |       BLAH8      |   etc...    |
|            |           |           |          |     1         |       BLAH7      |             |
|------------|-----------|-----------|----------|---------------|------------------|-------------|
|  5.6.3.2   |  4.3.2.1  |      7    |          |     4         |       BLAH5      |             |
|            |           |           |          |     2         |       BLAH6      |   etc...    |
|            |           |           |          |     1         |       BLAH7      |             |
|            |-----------|-----------|----------|---------------|------------------|-------------|
|            |  3.6.2.9  |           |   3      |     1         |       BLAH1      |             |
|            |           |           |          |     1         |       BLAH2      |   etc...    |
|            |           |           |          |     1         |       BLAH3      |             |
|            |-----------|-----------|----------|---------------|------------------|-------------|
|            |  3.6.2.9  |      3    |          |     1         |       BLAH2      |             |
|            |           |           |          |     1         |       BLAH3      |   etc...    |
|            |           |           |          |     1         |       BLAH4      |             |
|------------|-----------|-----------|----------|---------------|------------------|-------------|
|            |           |           |          |               |                  |             |
| and so on. |    etc... |    etc..  |  etc..   |   etc..       |      etc..       |   etc..     |
|            |           |           |          |               |                  |             |
 ------------------------------------------------------------------------------------------------

[somesoni2]

What is the requirement here? Could you provide more details how this loop (in your example) is done.