topic StealthWatch limit for number of flow records returned in Security Analytics

StealthWatch limit for number of flow records returned

sammausing — Tue, 18 Aug 2020 04:37:47 GMT

Hi Team,

May I know what is the maximum limit for the records to be returned from a query. Even if I set a higher number for max records returned in my flow query on WebUI or uncheck the record limit in desktop client, it does not return flows more than around 200k at a time.

Is there any setting on SMC which can remove the limit for number of flow returned.

Thanks.

Re: StealthWatch limit for number of flow records returned

kyoshiik — Tue, 18 Aug 2020 08:28:35 GMT

Do you run a parallel job(Flow Search query) at the same time?

Online help explain it.

You can perform a flow search for up to 400,000 flows in one search.

Flow searches with a Max Records Returned of 10,000 or less, as well as all top report jobs, run in a different queue from that of flow searches with a Max Records Returned of 20,000 or more.
You can run a maximum of four jobs at the same time if the Max Records Returned for the flow search is 10,000 or less. It does not matter what the Records Returned value is for a top report job.
You can run only one flow search at a time if the Max Records Returned is 20,000 or more.

Also, you can select how many "max record returned" in Flow Search.

I attached the image file.

If you select 20k+, you need to download csv file to get results.

If it still doesn't reach your expected number, please open TAC case.

Re: StealthWatch limit for number of flow records returned

sammausing — Fri, 21 Aug 2020 02:25:50 GMT

Thanks! I have already performed the 400,000 flow search several times but the search returns only 200k+ records. I am on v6.10.5. Does this make any difference. I will open a TAC for this.