SWQL query timeout

Can you give us some more context? Do some queries work but more complex ones give this timeout error? Or do you get this right away when you run SWQL Studio?

It took about 2 minutes before error.

Today it to be this error instead.

System.Exception: Error while executing FastBit query: 'SELECT ApplicationID AS C1, CASE WHEN ((Flags&3)<>0) THEN Bytes ELSE 0 END AS C2, CASE WHEN (SourceIP<DestinationIP) THEN DestinationAS ELSE SourceAS END AS C3, CASE WHEN (SourceIP<DestinationIP) THEN DestinationCountry ELSE SourceCountry END AS C4, CASE WHEN (SourceIP<DestinationIP) THEN DestinationDomain ELSE SourceDomain END AS C5, CASE WHEN (SourceIP<DestinationIP) THEN DestinationHostname ELSE SourceHostname END AS C6, CASE WHEN (SourceIP<DestinationIP) THEN DestinationIP ELSE SourceIP END AS C7, CASE WHEN (SourceIP<DestinationIP) THEN DestinationIPGroupSegmentID ELSE SourceIPGroupSegmentID END AS C8, CASE WHEN ((Flags&1)<>0) THEN InterfaceIDRx ELSE 0 END AS C9, CASE WHEN ((Flags&2)<>0) THEN InterfaceIDTx ELSE 0 END AS C10, NodeID AS C11, CASE WHEN ((Flags&3)<>0) THEN Packets ELSE 0 END AS C12, Port AS C13, Protocol AS C14, CASE WHEN (SourceIP<DestinationIP) THEN SourceAS ELSE DestinationAS END AS C15, CASE WHEN (SourceIP<DestinationIP) THEN SourceCountry ELSE DestinationCountry END AS C16, CASE WHEN (SourceIP<DestinationIP) THEN SourceDomain ELSE DestinationDomain END AS C17, CASE WHEN (SourceIP<DestinationIP) THEN SourceHostname ELSE DestinationHostname END AS C18, CASE WHEN (SourceIP<DestinationIP) THEN SourceIP ELSE DestinationIP END AS C19, CASE WHEN (SourceIP<DestinationIP) THEN SourceIPGroupSegmentID ELSE DestinationIPGroupSegmentID END AS C20, TimeStamp AS C21, ToS AS C22, TimeStamp AS C23, 0+0 AS C24, CASE WHEN ((Flags&1)<>0) THEN Bytes ELSE 0 END AS C25, CASE WHEN ((Flags&2)<>0) THEN Bytes ELSE 0 END AS C26, CASE WHEN ((Flags&1)<>0) THEN Packets ELSE 0 END AS C27, CASE WHEN ((Flags&2)<>0) THEN Packets ELSE 0 END AS C28, (CASE WHEN ((Flags&1)<>0) THEN Bytes ELSE 0 END+CASE WHEN ((Flags&2)<>0) THEN Bytes ELSE 0 END) AS C29, (CASE WHEN ((Flags&1)<>0) THEN Packets ELSE 0 END+CASE WHEN ((Flags&2)<>0) THEN Packets ELSE 0 END) AS C30, CASE WHEN ((Flags&8)=0) THEN ApplicationID ELSE 100001 END AS C31, CASE WHEN ((Flags&8)=0) THEN 1 ELSE 0 END AS C32

FROM Flows

WHERE (((Flags&3)<>0))'. Ended with error: There was an error reading from the pipe: The pipe has been ended. (109, 0x6d).

   at SolarWinds.Data.Providers.Orion.Netflow.FastBit.QueryRelation.SelectQueryRelation.<GetEnumerator>d__8.MoveNext()

   at SolarWinds.Data.Query.PhysicalQueryPlan.ProjectOp.<GetEnumeratorInternal>d__0.MoveNext()

   at SolarWinds.Data.Query.PhysicalQueryPlan.PhysicalQueryPlan.<GetEnumerator>d__0.MoveNext()

   at SolarWinds.InformationService.Serialization.XmlResponseSerializerSimple..ctor(IQueryResultReader reader, Boolean includeQueryPlan)

   at SolarWinds.InformationService.Serialization.XmlSerializer.GetSerializer()

   at SolarWinds.InformationService.Serialization.XmlSerializer.PrepareSerialize(IQueryExpr query, ISchema schema, IQueryResultReader reader)

   at SolarWinds.InformationService.Core.InformationService.RunQuery(String query, IDictionary`2 parameters, IDataSerializer serializer)

Ok, that helps. What was the original SWQL query? And what version of NTA are you using?

Query

SELECT ApplicationID, Bytes, DestinationASID, DestinationCountryCode, DestinationDomain, DestinationHostname, DestinationIP, DestinationIPGroupSegmentID, InterfaceIDRx, InterfaceIDTx, NodeID, Packets, Port, ProtocolID, SourceASID, SourceCountryCode, SourceDomain, SourceHostname, SourceIP, SourceIPGroupSegmentID, TimeStamp, ToSID, ObservationTimestamp, Description, IngressBytes, EgressBytes, IngressPackets, EgressPackets, TotalBytes, TotalPackets, EnabledApplicationID, ApplicationEnabled

FROM Orion.Netflow.Flows

"Orion.Netflow.Flows" represents every flow record in the system. Your query is requesting NTA to simply return all of them. I'm not surprised it timed out, but even if it had completed that wouldn't be a useful result. You need a WHERE clause. I would start with filtering on the TimeStamp property to a narrow range.

The SWIS entity model is designed for summarization/reporting purposes, it has not been meant to be used for dumping flows. Adding more filtering, especially by TimeStamp property, is really good start. Also, GROUP BY clause aggregating data by certain properties is a typical construct used in reports. What is your specific intention you want to express by a query?