Troubleshooting
Problem
There is no longer an option to display 'Unioned Flows' in IBM QRadar products as of version 7.2.1 (MR1).
Symptom
In the Network Activity tab, the Display: drop-down box will no longer list a Unioned Flows option.
Cause
The Unioned Flows view displayed several flows in one uninterrupted pattern across several intervals, in a single record. This functionality was removed beginning in version 7.2.1 (MR1). However, the Users Guide and QRadar Online Help still refer to this functionality.
Resolving The Problem
All references to Unioned Flows will be removed from the documentation in a future release.
To obtain the equivalent results to the Unioned Flows display option, perform the following search:
In the Network Activity tab, perform a time-series search. Then, Group By Source IP, Source port, Destination IP, Destination Port, and Protocol.
Where do you find more information?
Was this topic helpful?
Document Information
Modified date:
21 June 2018
UID
swg21670335