FlowFalcon Views

FlowFalcon views enable you to use the flow data that devices send to SevOne NMS in FlowFalcon reports. When you enable a device to send flow data to SevOne NMS, the device sends flow packets in the format of flow templates that contain metrics and keys. The FlowFalcon View Editor enables you to define FlowFalcon views that are specific to your flow report requirements. For details, please refer to sections Enable Flow Technologies and FlowFalcon View Editor in SevOne NMS System Administration Guide.

There are two types of FlowFalcon report views.

• Aggregation Disabled views use raw flow data to allow for more specificity in the result set at the trade off of longer report execution times and less historical data availability.
• Aggregation Enabled views use aggregated flow data to present the most relevant flow data for faster report creation. You can choose to run each aggregation enabled view in the aggregation disabled mode to use raw flow data. Your SevOne appliance hardware determines the maximum number of aggregated views.
  Note: When you create a TopN flow report (e.g., Top Talkers) based on aggregated data, the report will not be entirely precise. You can increase the value for the Aggregation TopN setting (go to Cluster Manager -> Cluster Settings -> FlowFalcon) for greater precision. However, any value greater than 100 will increase the system load, which may eventually lead to data loss.

SevOne NMS provides starter set FlowFalcon Reports views to enable you to run common flow reports right out of the box. The default view is Top Talkers (Bandwidth, Packets, Flows).