This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

NetFlow Conversations Summary - can't get specified time period

We are having an issue, when we try to adjust the Absolute Time Period for the display of the top 10 NetFlow Conversations.

For example we wanted to select 11/4/2012 between 2pm and 4pm.   The displayed results were 11/4/2012 between 12am and 4pm.

I'm sure I'm missing something simple, but has anybody else run into this?


Thanks!

  • Hi Chris,

    this is caused by way how NTA currently stores data in SQL server.

    By default it stores 1 minute samples, by after 1 hour it aggregates them and store as 15 minutes samples, after a day it goes to 1 hour samples, and after 3 days the data are stored as daily samples. Only sample start time is preserved during this process, so NTA treats the flow as it lasted for whole rest of sample period.

    When NTA than queries data, it adjusts the time range to cover beginning of nearest sample period, and shows flows which started later then that beginning.

    So as 11/4/2012 is older than 3 days, the initial time is rounded to beginning of that day showing you all flows that started before 4pm that day.