SWQL Studio not able to access/ read all the tables

Which version of NTA do you have? Are you trying to interrogate the flow storage database or the main Orion database?

Rawwinton,

Your queries span obviously too much data to process as there are no efficient time constraints or any other filtering criteria.

The first query orders all the netflow records by Bytes values, however Bytes column is not indexed, thus the query needs to go through all the records. Once processed, first 5 records are returned.

The second query is similar, although one could think that it takes just first 10 records (no ordering, grouping, etc.) which should be fast. However, there is no such optimization as typical TOP queries usually orders records before.

Tom is right, such queries require time constraint to work properly.

The easiest fix would be:

SELECT TOP 10 ApplicationID, Bytes
FROM Orion.Netflow.FlowsByIP
WHERE (TimeStamp >= '2015-06-01 10:00:00') AND (TimeStamp <= '2015-06-01 16:00:00')

If you're after top 10 applications by bytes, I would start with something like this:

SELECT TOP 10 ApplicationID, f.Application.Name, SUM(Bytes) AS TotalBytes
FROM Orion.Netflow.Flows f
WHERE (TimeStamp >= '2015-06-01 10:00:00') AND (TimeStamp <= '2015-06-01 16:00:00')
GROUP BY ApplicationID, f.Application.Name
ORDER BY TotalBytes DESC

Regards,

Martin

Thanks for all the replies had gotten it to work.

Rawwinton