Query runs forever until server runs out of resources

Question

I am attempting to run the following query using the SWIS powershell module and when I execute the script it runs for seemingly forever until my primary poller runs out of RAM.

SELECT TOP 1 ApplicationID, AdvancedApplicationID, Bytes, DestinationASID, DestinationCountryCode, DestinationDomain, DestinationHostname, DestinationIP, DestinationIPGroupSegmentID, InterfaceIDRx, InterfaceIDTx, NodeID, Packets, Port, ProtocolID, SourceASID, SourceCountryCode, SourceDomain, SourceHostname, SourceIP, SourceIPGroupSegmentID, TimeStamp, ToSID, ObservationTimestamp, Description, IngressBytes, EgressBytes, IngressPackets, EgressPackets, TotalBytes, TotalPackets, EnabledApplicationID, ApplicationEnabled FROM Orion.Netflow.FlowsByConversation

The InformationService.log and InformationServicev3.log show no errors around execution time.

It would be my guess that this should only run for a few seconds not 3 hours then crash. I even tried only to return the NodeID with this query and still the same issue.

Does anyone have any insight into what may be going on?

tdanner · Accepted Answer

Running a query like this with no WHERE clause forces the system to scan all the flow data. NTA 4.0 Entity Model · solarwinds/OrionSDK Wiki · GitHub  has more information about how to query Netflow data effectively.