## 5 Results
### Experimental Analysis
#### 5.2.4 Experiment 4: Comparing the Speeds of the New Enhanced Algorithm and General Compressors
In terms of compression, out of all combinations, the joint use of MoLFI and PPMd proved to be the fastest, while the combination of MoLFI and LZMA takes less time to decompress the data. The use of any combination is considered to be fast. Figure 22:0 The compression rates of the joint use on the D dataset. Figure 22:1 The speeds of the joint use on the Small dataset. Figure 22:2 The speeds of the joint use on the Large dataset. Figure 22:3 The speeds of the joint use on the Big dataset. Figure 22:4 The speeds of the joint use on the Mid dataset. 2.7 Experiment 7: Comparing the Speeds and the Storage Sizes Needed to Retrieve All Instances of an Event Type by the New Enhanced Algorithm and General Compressors  
In this experiment, we randomly selected 10 and 100 templates and investigated the time and storage space that were needed to recover all log entries that correspond to a template in the set. For this experiment, the previously introduced A dataset was used. Figures 39 and 40 show the results of the experiment. Since we can find the corresponding log entry based on the ID of the template, in the case of our algorithm, only the Huffman decoding step is necessary. This requires more time than decompressing with a general compressor; however, the time needed to look up the entries is considerably less. The reason behind this is that we only need to check the first \(n\) characters of the encoded file (where \(n\) is the length of the ID), rather than checking all the constant tokens. The storage size needed is much larger in the case of general compressors, since a full decompression of the data is necessary to look for templates, while, in the case of our algorithm, the intermediate compressed file is enough. In the case of dataset A, this means 2 GB for the general compressors, while only 290 MB for our algorithm. We also wanted to measure the time needed to retrieve the entries when our algorithm is used in conjunction with a general compressor. Since, in Section 5.2.5, the joint use of the proposed method and PPMd had the best compression rate, we chose PPMd as the general compressor for this experiment. The compressed file is first decompressed with PPMd, then the compressed file is decoded using the Huffman algorithm. The results can be seen in Figures 41 and 42. Figure 22:5 The times needed to recover all instances of the 100 template. Figure 22:6 The times needed to recover all instances of the 10 template. It can be seen that the decompression time increases with the time taken by the PPMd to decompress the dictionaries and the compressed file generated by our algorithm, but it can still quickly recover the entries corresponding to the randomly selected templates. There is no difference in the space required to lookup the entries. 2.8 Experiment 8: The Comparison of the Compression Rates Achieved by the Proposed Algorithm and Logzip  
It is also important to compare the compression rates of the proposed method and other algorithms that use the same approach. Like our algorithm, Logzip [19] also utilizes hidden structures (templates) to reduce the size of a file. It also uses the general compressor. Bzip2 to further decrease the size. In this experiment, we compare the achieved compression rates in the case of the previously mentioned datasets, A, B, and C. The results can be seen in Figure 22:7  
Figure 22:8 The times needed to recover all instances of the 10 template in case of the joint compression. Figure 22:9 The times needed to recover all instances of the 100 template in case of the joint compression. Our method has a compression rate that is approximately 1% higher than Logzip's. In contrast with Logzip, our algorithm does not incorporate the use of general algorithms. With the joint use, our method could achieve higher rates as explained in Section 5.2.5.