• State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 24 subscribers
  • Views 491 views
  • Users 0 members are here
Options
Related
This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Digging Deeper into Netflow Data

trivialpants

I have netflow data coming from several sources & I am wanting to see what the itemized endpoints are for the top users. I see the top 5. For the first 5 I get addresses and the rest just go to 'Remaining Traffic' how can I retrieve data, if possible, from NTA to see what the rest of the netfow data looks like? Is it pre-compiled in the database as 'remaining traffic' or is that just on the report? 

Thanks for any help or suggestions!

  • 0
    The quick solution is just to edit the widget and change it from top 5 to a higher number. I go top 25 on many of my details widgets
  • 0 in reply to mesverrum

    Hi  

    Thanks for the response. This will help out some. I assume that the netflow data we capture with solarwinds is viewable in full until the 30 day expulsion period set (by default, in our case). We had a large influx of traffic, not sure if it was a DDOS or not yet, but are wanting to see if we can see where exactly the traffic came from. It looks like it would require more than the 25 results, even. 

    Do you or any others happen to know how we can parse through this data?

  • 0 in reply to trivialpants
    There's a built in report of top 100, you can modify that and remove the top xx bits but reporting on netflow can time out when you try to present too much data in a single go. When you need a really big chunk you can use SSMS to write queries directly against the netflow database since there is no timeout built into sql it'll just keep going until it's done.

SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.

SolarWinds Customer Success Center Certification Media Vault Link Accounts
About THWACK Blogs For Government Edit Settings Free Tools & Trials
Legal Documents Terms of Use Privacy California Privacy Rights Security Information
©2024 SolarWinds Worldwide, LLC. All Rights Reserved.