SWQL query to show total traffic per interface and using time range.

Hello everyone,

I´m trying to get some information using SWQL and put the information in a dashboard using table widgets.
My goal is get node name, target, interface ID and total bytes, but I need to restrict the data using time range.

Does anyone have any suggestion or other tables to join to these?

SELECT

N.NodeName,

I.InterfaceName,

F.InterfaceID,

F.DestinationHostname,

F.DestinationIP,

F.TotalBytes

FROM Orion.Netflow.FlowsByInterface AS F

JOIN Orion.Nodes AS N ON F.NodeID = N.NodeID

JOIN Orion.NPM.Interfaces AS I ON F.InterfaceID = I.InterfaceID

WHERE

( F.DestinationHostname LIKE '%xxxx%'

OR F.DestinationHostname LIKE '%xxxx%')

AND N.NodeName LIKE '%XXX%'

Tks

Find more posts tagged with

Accepted answers

All comments

BLG

Please, if anyone has any suggestion let me know. Reports, other widgets, etc.

Seashore

SELECT
    F.Node.NodeName
    ,I.InterfaceName
    ,F.DestinationHostname
    ,F.DestinationIP
    ,SUM(F.TotalBytes) AS TotalBytes
    ,DATETRUNC('HOUR',F.TimeStamp) AS [HOUR]
FROM Orion.Netflow.FlowsByInterface AS F
JOIN Orion.NPM.Interfaces AS I ON F.InterfaceID = I.InterfaceID
WHERE
   ( F.DestinationHostname = 'xxx'
    OR F.DestinationHostname LIKE '%xxxx%'
    )
    AND  F.Node.NodeName = 'xxxx'
    AND F.TimeStamp>ADDDAY(-1,GETUTCDATE())
GROUP BY 
    DATETRUNC('HOUR',F.TimeStamp)
    ,F.Node.NodeName
    ,I.InterfaceName
    ,F.DestinationHostname
    ,F.DestinationIP
ORDER BY [HOUR]

Something like this?

BLG

Thank you very much!