Adjusting Time Variables and Host Names in Netflow Dashboard

Question

I am currently working on a creating a Modern Dashboard widget to show the top conversations for the last hour but the start/end times are longer than one hour. I am also trying to see if there is a way to get the hostnames to resolve to the endpoints name if possible. What I have so far is

SELECT TOP 5
    MIN(TimeStamp) AS StartTime,
    MAX(TimeStamp) AS EndTime,
    SourceIP as A_IP,
    SourceHostname as A_Hostname,
    DestinationIP as B_IP,
    DestinationHostname as B_Hostname,
    ROUND(SUM(Bytes) / 1024.0 / 1024.0 / 1024.0, 2) As BytesGB, -- Convert Bytes to Gigabytes
    ROUND(SUM(IngressBytes) / 1024.0 / 1024.0 / 1024.0, 2) as IngressBytesGB, -- Convert IngressBytes to Gigabytes
    ROUND(SUM(EgressBytes)  / 1024.0 / 1024.0 / 1024.0, 2) as EgressBytesGB, -- Convert EgressBytes to Gigabytes

SUM(IngressPackets) as IngressPackets,
    SUM(EgressPackets) as EgressPackets,
    SUM(Packets) as Packets
FROM Orion.Netflow.FlowsByConversation
WHERE Timestamp >= ADDHOUR(-1, GETDATE())
GROUP BY SourceIP, DestinationIP, SourceHostname, DestinationHostname
ORDER BY SUM(Bytes) DESC

mesverrum · Answer

https://documentation.solarwinds.com/en/success_center/nta/content/nta-configuring-dns-and-netbios-resolution-sw353.htm

That article talks about how to control the settings around DNS resolution, but its worth mentioning that a LOT of IP addresses you communicate with are usually not able to be resolved into DNS, or they get resolved to a CDN/Cloud provider which often doesnt help very much.

If you are dealing in a 1 hour widget then I don't think that trying to determine the start and endtime the way you are doing it is really meaningful, like you said it is very common for a convo to run much longer than the 1 hour span of time you are presenting in the widget so lots of the convos are just going to display the timestamp for the start of your where condition.  I'd just remove those completely if it was me.  If you want to understand the way traffic of a given convo starts/ends/changes you would be much better served by displaying that in a timeseries widget.

stuartd · Answer

I can't help you with you SWQL query but I hope you post the completed dashboard to the Modern Dashboards sub-forum.