Problem getting data using SWQL studio from Orion.Netflow.ConversationsTop NTA 3.11

Hello,

Press F4 key (or menu Query ->Parameters) to define the query parameters dictionary.

I hope it helps.

Regards,

Honza.

Honza, that is for query parameters, which is separate from entity parameters. I'll ping the NTA team to provide the details Simon needs.

Ah,

many thanks, Tim, for clarification.

And huge sorry for misunderstanding.

Regards,

Honza

Hi Tim,

Were you able to get any more detail from the NTA team on this.

Thanks

Simon

No response from them yet. Sorry about that. I will poke them.

Until they respond, I can at least tell you that Orion.NetFlow.ConversationsTop expects three parameters: Filter, Limit, and TopKey. Try removing the Tx and Rx parameters from your query and see if it starts working.

Thanks, that did it

This worked for me

SELECT ConversationID, IPSort1, IPAddress1, HostName1, IPSort2, IPAddress2, HostName2, NodeID, InterfaceID, TotalBytes, TotalPackets, TotalBytesIngress, TotalBytesEgress, TotalPacketsIngress, TotalPacketsEgress

FROM Orion.NetFlow.ConversationsTop(Filter='NSF:TD:2013-10-16T09:00:00~2013-10-16T10:00:00,1,True,True', Limit=5, TopKey='')

My next task is to convert this into a cURL / REST call. I think I will need some help

I can convert the first part pretty easily, but I'm not sure what to do with the Filter

curl -k -X GET -H "Content-Type:application/json" -H 'Accept:application/json' https://admin:@x.y.z.a:17778/SolarWinds/InformationService/v3/Json/Query?query=SELECT+ConversationID+,+IPSort1+,+IPAddress1+,+HostName1+,+IPSort2+,+IPAddress2+,+HostName2+,+NodeID+,+InterfaceID+,+TotalBytes+,+TotalPackets+,+TotalBytesIngress+,+TotalBytesEgress+,+TotalPacketsIngress+,+TotalPacketsEgress+FROM+Orion.NetFlow.ConversationsTop

# the above gives the initial error from the previous post

Do I need to asciify (is that a word) the characters in the filter

%28+Filter+ etc.....

I tried a bit of that without any success. Any pointers will be appreciated.

I always get a little more bald when I try to use curl from the cmd.exe command line with a complex URL. I recommend you use the POST form of /Query so you can avoid dealing with cmd.exe's insane quoting rules. Like this:

curl -k -X POST -H "Content-Type: application/json" -d @postdata.txt https://admin:@x.y.z.a:17778/SolarWinds/InformationService/v3/Json/Query

Where postdata.txt contains:

{"query":"SELECT ConversationID, IPSort1, IPAddress1, HostName1, IPSort2, IPAddress2, HostName2, NodeID, InterfaceID, TotalBytes, TotalPackets, TotalBytesIngress, TotalBytesEgress, TotalPacketsIngress, TotalPacketsEgress FROM Orion.NetFlow.ConversationsTop(Filter='NSF:TD:2013-10-16T09:00:00~2013-10-16T10:00:00,1,True,True', Limit=5, TopKey='')"}

Tim,

I really appreciate your help so far, but I was not able to get it working.

I'm getting this whacky message, I tried it in a file, and directly in the cURL command

{"Message":"Unknown provider NetFlowCustomEntity."}

[user PlexxiControlCLI]# cat postdata.txt

{"query":"SELECT ConversationID, IPSort1, IPAddress1, HostName1, IPSort2, IPAddress2, HostName2, NodeID, InterfaceID, TotalBytes, TotalPackets, TotalBytesIngress, TotalBytesEgress, TotalPacketsIngress, TotalPacketsEgress FROM Orion.NetFlow.ConversationsTop(Filter='NSF:TD:2013-10-16T09:00:00~2013-10-16T10:00:00,1,True,True', Limit=5, TopKey='')"}

# curl -k -X POST -H "Content-Type: application/json" -d @postdata.txt https://admin:@192.168.1.1:17778/SolarWinds/InformationService/v3/Json/Query

{"Message":"Unknown provider NetFlowCustomEntity."}

#curl -k -X POST -H "Content-Type:application/json" -H "Accept:application/json" -d '{"query":"SELECT ConversationID, IPSort1, IPAddress1, HostName1, IPSort2, IPAddress2, HostName2, NodeID, InterfaceID, TotalBytes, TotalPackets, TotalBytesIngress, TotalBytesEgress, TotalPacketsIngress, TotalPacketsEgress FROM Orion.NetFlow.ConversationsTop(Filter=\u0027NSF:TD:2013-10-16T09:00:00~2013-10-16T10:00:00,1,True,True\u0027, Limit=5, TopKey=\u0027\u0027)"}' https://admin:@192.168.1.1:17778/SolarWinds/InformationService/v3/Json/Query

{"Message":"Unknown provider NetFlowCustomEntity."}

I see the problem. NTA 3.11 is still only on SWISv2, but the JSON API is only on SWISv3. To get NTA 3.11 data over HTTP you will have to use SOAP.