One of my co-workers was trying to find flows for a given subnet so I had them go to search by endpoint and put the subnet in.
It returned every IP in the subnet range, whether it had data flows or not.
I would think/request that when I put a range in like that, for a given time period, it would search the DB and return only IPs and flows for interfaces that have traffic.
thoughts/comments...SW?
thanks