Scrutinizer data history

[Koen]

I was not sure to place this post under the Scrutinizer or Flow analytics forum. Please move if necessary.


There is nothing noted in the help file about this: when I edit the data history settings, is the new setting applied to every yet existing flow exporter at once, at some point later, or only for new devices?

I'm asking since I've reconfigured some of these settings, having data of the shorter intervals (1m/5m) stored for a longer period. However this does not seem to work: for example last friday I have set 'Historical 1 Min Avg'* to 336 hour (=2 weeks). Now, after at least 3 full days, I can create a filter containing 1 device and specific interface with data range 'Yesterday'. On the 'Data granularity' box the '1m' option is greyed out, with only the 5m and higher intervals being available. What's wrong?


offtopic
* In my opinion the description for the first box 'Historical 1 Min Avg' is wrong: data from the 1 min interval is not aggregated and thus not an average (in contradiction to 5min/30min/2hr/etc).

[jghidoni]

Hello Koen,

The data history settings changes you make take effect immediately for all devices. The only change that is not retroactive would be the Max Conversations, as that will only change the Max Conversations saved moving forward, it does not go back into historical data and reduce the Max Conversations previously saved.

The issue you are referring to is a different issue.

We limit when certain time increments can be viewed, in your example you are looking at 'Yesterday', which is a 24 hour time period. We do not allow displaying 1 minute data for a length of 24 hours as the data points in the graph would be completely illegible.

You can test that your new historical data settings have taken effect by going back in time further than what was set before, ie., if you have 168 hours (1 week) prior to extending to 2 weeks, then go back 8 or 9 days and see if you have 1 and 5 minute data available. Again, you will only be able to report up to the point that 1 and 5 minute data can legibly be displayed.

1 minute data is not available in reports of more than 5 hours duration.

- Joanne

[Koen]

Great explanation, I can confirm everything works the way you've explained.

[mtsreid2]

I have a similar issue. As I now, I have several hundred devices in the system, and I can't go back over 1hr in 1min intervals. It comes up with the following message;

The current report requires the following columns:
commonPort, destinationIPAddress, egressInterface, ingressInterface, sourceIPAddress, octetDeltaCount
Device(s) exports the following templates:

None

This is the output when I attempted to go back 4 hours on a device and start at that point and then go forward 2 hours.

Running Scrutinizer 8.6.1.14902, Fully licensed with flow analyzer.

Can someone please assist? Thanks

[mtsreid2]

Also to add, I can't display the 24 Hour report either. It returns the same error message

[BenjaminM]

Hello mtsreid2,

We have contacted you via email in regard to this issue to further investigate what is going on.