1 Reply Latest reply on Mar 22, 2017 10:14 PM by tdanner

    Joining Node Data to Conversation Query


      I'm attempting to grab a snapshot of conversation data in SWQL Studio and am having some problems linking the data back to a node (so I can run the query on a per-customer basis).  Here's what I have so far:


      SELECT ConversationID, IPSort1, IPAddress1, HostName1, IPSort2, IPAddress2, HostName2, NodeID, InterfaceID, TotalBytes, TotalPackets, TotalBytesIngress, TotalPacketsIngress, Conv.OrionSite.Uri

      FROM Orion.NetFlow.ConversationsTop(Filter='NSF:TD:2013-10-16T09:00:00~2018-10-16T10:00:00,1,True,True', Limit=500, TopKey='') AS Conv

      ORDER BY HostName2


      Unfortunately, the NodeID always returns null, so I can't join on that, and I don't see anywhere else that identifies which node is providing the conversation data.  Any help would be appreciated.