I'm attempting to grab a snapshot of conversation data in SWQL Studio and am having some problems linking the data back to a node (so I can run the query on a per-customer basis). Here's what I have so far:
SELECT ConversationID, IPSort1, IPAddress1, HostName1, IPSort2, IPAddress2, HostName2, NodeID, InterfaceID, TotalBytes, TotalPackets, TotalBytesIngress, TotalPacketsIngress, Conv.OrionSite.Uri
FROM Orion.NetFlow.ConversationsTop(Filter='NSF:TD:2013-10-16T09:00:00~2018-10-16T10:00:00,1,True,True', Limit=500, TopKey='') AS Conv
ORDER BY HostName2
Unfortunately, the NodeID always returns null, so I can't join on that, and I don't see anywhere else that identifies which node is providing the conversation data. Any help would be appreciated.