Anyone know of a query to help collect the flows per second per interface or per source router?
Have you looked here - Flow sources management (solarwinds.com)
hi lerdalt
i don't think its possible to identify the received flow per second per interface source. but, for sure you can identify the flows received per seconds by using windows perfmon in your NTA collector.
refence:
I know this is a very old post, but recently I needed to create such a widget and was able to do it via Custom Query.
If anyone still need it, I am pasting it below. By default, it is counting flows for each hour (last 4 hours).
Each hour is defined by downsampling to '01:00:00' and it can be easily modified within the query.
NetFlow per Interface
SELECT i.FullName AS [Interface] ,i.detailsurl as [_linkfor_Interface] ,'/Orion/images/StatusIcons/Small-' + i.StatusIcon AS [_IconFor_Interface] ,Downsample(TOLOCAL(flows.Timestamp),'01:00:00') AS [Hourly] ,count(*) as [Hourly Flows] FROM ( SELECT Timestamp, InterfaceID FROM Orion.Netflow.FlowsByInterface WHERE Timestamp >= AddDate('hour', -4, GETUTCDATE()) ) flows LEFT JOIN Orion.NPM.Interfaces i ON flows.InterfaceID = i.InterfaceID --WHERE i.FullName like '%${SEARCH_STRING}%' GROUP BY Downsample(TOLOCAL(flows.Timestamp),'01:00:00'), flows.InterfaceID, i.FullName, i.DetailsUrl, i.StatusIcon ORDER BY count(*) DESC
NetFlow per Device
SELECT n.Caption AS [Device] ,n.detailsurl as [_linkfor_Device] ,'/Orion/images/StatusIcons/Small-' + n.StatusIcon AS [_IconFor_Device] ,Downsample(TOLOCAL(flows.Timestamp),'01:00:00') AS [Hourly] ,count(*) as [Hourly Flows] FROM ( SELECT Timestamp, InterfaceID FROM Orion.Netflow.FlowsByInterface WHERE Timestamp >= AddDate('hour', -4, GETUTCDATE()) ) flows LEFT JOIN Orion.NPM.Interfaces i ON flows.InterfaceID = i.InterfaceID LEFT JOIN Orion.Nodes n ON n.NodeID = i.NodeID --WHERE i.FullName like '%${SEARCH_STRING}%' GROUP BY Downsample(TOLOCAL(flows.Timestamp),'01:00:00'), n.Caption, n.DetailsUrl, n.StatusIcon ORDER BY count(*) DESC
Kind regards,
Marcin.
Hello stibi
Thanks for the info. I am glad that SolarWinds is finally adding those statistics.
Although current implementation is very limited, as shown below. We only get fixed time periods (last 5 min, last 24 hours, last 3 days) and there is no SUM option. Too bad it is not using time periods. Also, it does not show flows per interface.
For now, I will use my SWQL widgets
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 200,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.