Hi Kurt and Racquel,
As you know, Netflow is not stored by default and this is why you have trouble viewing it in a query. However, even in this state you can view it, albeit in real time only. So, if you were to set up a real time query and filter on a device sending Netflow, it should show up in the query. To further filter, you can add a keyword of "Netflow" (case sensitive) to the query under the keyword heading on the query page, so, you can narrow the results. Here is the link on real time queries:
http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.1/user/guide/combo/q_report.html#wp682040
Here is an example of the query and you can see the Netflow showing up (taken from my MARS NOT storing Netflow):
Query Event Data
Click the cells below to change query criteria:
Query type: Event Raw Messages ranked by Time, Real Time(raw events) Edit Clear
Source IP Destination IP Service Events Device Reported User IPS Risk Rating IPS Threat Rating IPS Global Correlation Score Keyword Operation Rule Action
ANY ANY ANY ANY ANY ANY ANY ANY ANY Netflow None ANY ANY
Query Results
Event ID Event Type Time Reporting Device Raw Message
1032448044 Built/teardown/permitted IP connection Oct 22, 2010 6:00:08 PM CDT name Cisco Netflow : bytes: 504 , packets: 2
1032448045 Built/teardown/permitted IP connection Oct 22, 2010 6:00:08 PM CDT name Cisco Netflow : bytes: 504 , packets: 2
1032448046 Built/teardown/permitted IP connection Oct 22, 2010 6:00:08 PM CDT name Cisco Netflow : bytes: 410 , packets: 2
1032448047 Built/teardown/permitted IP connection Oct 22, 2010 6:00:08 PM CDT name Cisco Netflow : bytes: 120 , packets: 2
1032448048 Built/teardown/permitted IP connection Oct 22, 2010 6:00:08 PM CDT name Cisco Netflow : bytes: 120 , packets: 2
1032448049 Built/teardown/permitted IP connection Oct 22, 2010 6:00:08 PM CDT name Cisco Netflow : bytes: 60 , packets: 1
1032448050 Built/teardown/permitted IP connection Oct 22, 2010 6:00:08 PM CDT name Cisco Netflow : bytes: 432 , packets: 1
1032448051 Built/teardown/permitted IP connection Oct 22, 2010 6:00:08 PM CDT name Cisco Netflow : bytes: 432 , packets: 1
1032448052 Built/teardown/permitted IP connection Oct 22, 2010 6:00:08 PM CDT name Cisco Netflow : bytes: 207 , packets: 1
1032448053 Built/teardown/permitted IP connection Oct 22, 2010 6:00:08 PM CDT name Cisco Netflow : bytes: 227 , packets: 1
1032448054 Built/teardown/permitted IP connection Oct 22, 2010 6:00:08 PM CDT name Cisco Netflow : bytes: 227 , packets: 1
1032448055 Built/teardown/permitted IP connection Oct 22, 2010 6:00:08 PM CDT name Cisco Netflow : bytes: 60 , packets: 1
1032448056 Built/teardown/permitted IP connection Oct 22, 2010 6:00:08 PM CDT name Cisco Netflow : bytes: 60 , packets: 1
1032448057 Built/teardown/permitted IP connection Oct 22, 2010 5:59:54 PM CDT name Cisco Netflow : bytes: 206 , packets: 5
Once you change your settings to store Netflow as it sounds like you have done, the Netflow events are stored in the database just as any other event. In fact the performance numbers go way down on MARS because of this. So, take for example a MARS 110 specs:
Events Per Second Netflow Events Per Second
When you store Netflow, all events including netflow are limited to the 4500 number. So, this is why it is not recommended to do so in most cases. However, when you store netflow, you should then be able query them as you would any event as it is treated pretty much like any other event. You can always do a "all matching events raw message" query and use a keywork "Netflow" to find these events if need be.
Don't forget to narrow down your query enough so that you don't return too many events. So, in addition to putting in a keyword of "Netflow", also filter on a single device (perhaps a slower device in terms of EPS), to help reduce the amount of events. Note that my example above was done in a lab.
I hope this helps,
Ron
