Comparing data from different resources
This topic applies to all SolarWinds Platform products.
People often compare from different views, such as an NPM interface traffic graph with an NTA top applications stacked area chart. While this can be a valid method for determining more information about a particular resource, you need to be aware of some pitfalls.
Starting with Orion Platform 2017.1, you can visually correlate data from various SolarWinds Platform products using Performance Analysis Dashboards.
Disparate data sources
When comparing resources you must consider the sources of the data displayed. You may compare an interface utilization graph from NPM with a NetFlow resource for the same interface in the same time period. Although we might assume at first that these should be the same, they are often different.
Consider that the NPM data source is all traffic as recorded on the device’s SNMP agent and polled by NPM every 9 minutes, but, the NetFlow traffic is only IP traffic as recorded by the device’s NetFlow exporter. This data is exported to the NTA module every minute. There are two opportunities for the data to differ here:
- The data counted by an SNMP interface counter has different criteria than the data counted by a NetFlow collector
- The data collection time periods vary by a factor of 9.
While many times these two types of data will be roughly similar, there is opportunity for them to differ significantly. You should make sure that the two graphs you are comparing are using the same data period, intervals and that the Y-axis is set to the same units for both graphs.
Graphing differences between views
Another issue that can make the data seem invalid is comparing resources with different criteria. Again if one compares an NPM interface utilization with a Top 5 applications graph in NTA the two will not align. The issue here is that the NPM interface graph is showing the total amount of data to cross that interface and the NTA graph is showing only traffic for the top 5 IP applications.
Graphing differences within a single view
The most common place for finding graphing differences in a single view is comparing an NTA Top X Endpoints resource with any other NTA Top X resource for the same period. Typically, the top endpoints resource shows twice the traffic of the other resource. This is because the top endpoints are both top receivers and top talkers. All of the data associated with an endpoint is summed to calculate the total data for an endpoint. Knowing that the data is counted both to and from the endpoint, we would expect the data to be double.
Example resources:
