1 Reply Latest reply on Jul 26, 2017 2:54 PM by tdanner

    Timeout error while trying to query Orion.Netflows.Flows in SWQL studio

    soumen_mukherjee

      Hi,

       

      I have to extract Netflow details full list of all the conversations using SWQL studio. The query was getting timed out after 2 minutes. Increased the timeout in the file

      C:\Program Files (x86)\SolarWinds\Orion SDK\SWQL Studio\SwqlStudio.exe.config

       

      But still it is getting timed out at the higher time out period(increased it to about 30 minutes).

       

      The query used was  "Select ApplicationID,DestinationIP,Packets,Ports,ProtocolID,SourceIP,TimeStamp FROM Orion.Netflow.Flows" . Even tried to fetch for top 100 but it timed out.

       

      Is there a way I could extract these information.

        • Re: Timeout error while trying to query Orion.Netflows.Flows in SWQL studio
          tdanner

          In a typical production environment, the amount of data you are talking about can be extremely large. A GUI tool like SWQL Studio would choke on that data just loading it into the grid even if the query itself didn't timeout. If you want to export all of your flow data, I recommend trying a different approach: iterate through the data by timeslices using a powershell script.

           

          First, use SWQL Studio to write a query that selects a small time range of flows. Like this:

           

          Select ApplicationID,DestinationIP,Packets,Ports,ProtocolID,SourceIP,TimeStamp FROM Orion.Netflow.Flows WHERE TimeStamp > '2017-07-26T12:00:00' AND TimeStamp < '2017-07-26T12:01:00'

           

          That will give you one minute of data. Test it in SWQL Studio to make sure that it works and you are getting the data you expect. Adjust the time range so you are getting "reasonable" number of flows in each time slice. I would aim for around 10,000 flows - that should be a manageable chunk to work with. Assuming that works, then it is time to make the script. Let me know if you want a hand with that part.