Unable to execute a SELECT / UNION ALL in the SWQL Studio

You need parenthesis around the second SELECT statement. Like this:

select TimeStamp, NodeID, InterfaceIDRx, Port, SourceIP, DestinationIP, IngressBytes, protocolID
from Orion.Netflow.Flows
where InterfaceIDRx = 917
  and TimeStamp >= '2014.12.17 19:10:00'
  and TimeStamp <  '2014.12.17 19:11:00'

UNION ALL (

select TimeStamp, NodeID, InterfaceIDTx, Port, SourceIP, DestinationIP, EgressBytes, protocolID
from Orion.Netflow.Flows
where InterfaceIDTx = 917
  and TimeStamp >= '2014.12.17 19:10:00'
  and TimeStamp <  '2014.12.17 19:11:00'
)

Hi tdanner,

Thanks for your reply!

When I run your query I get the following error in the SWQL Studio:

When I execute it from Java (just in case it would be an SWQL Studio bug):

     java.net.SocketException: Connection reset

The syntax of the query looks fine, so I suspect a problem specific to Orion.Netflow.Flows. I have forwarded your question to someone who knows more about that particular entity.

Thanks a lot! Note that if I run the SELECT independently it works fine. I'm therefore able to query the 'Flows' table. The issue is related to the UNION.

Unfortunately, really, the UNION is not supported in the context now, specifically in situations when concatenating two queries getting data just from Orion.Netflow.Flows. Executing the queries separately really works, this may be an option for you if you can combine the results on the client side.

Thanks tom.rybka for your reply! I'll do it in Java then.