Hello,
I am trying to create a report that shows me flows that have stopped from yesterday. I have some netflow sources configured that show streams from my security cameras. I would like a report (and eventually an alert, but that is another thwack post) that will tell me when these flows no longer exist. I think my where statement is correct but I keep getting the error "no viable input at EXISTS in where clause". Can anyone look this over and point me in the right direction? Thanks
SELECT Top 10 F.NodeID, NC.City, A.Name, F.SourceIP, SUM(F.TotalBytes) AS TotalBytes
From Orion.NetFlow.Flows AS F
LEFT JOIN Orion.Nodes N ON F.NodeID = N.NodeID
LEFT Join Orion.NodesCustomProperties NC ON N.NodeID = NC.NodeID
LEFT JOIN Orion.NetFlow.Applications A on A.ApplicationID = F.ApplicationID
WHERE
NOT EXISTS
(Select FL.SourceIP FROM Orion.NetFlow.Flows FL WHERE FL.TimeStamp BETWEEN (F.TimeStamp>=(GetUTCDate()-0.04167)) AND (FL.TimeStamp>=(GetUTCDate())))
ORDER BY TotalBytes DESC