I'm using a very simple query to pull back all hosts from NetWitness for offline analysis. You can see a small sample of the results below. The query for alias.host returns all values, which have many redundant entries.
The same query using Investigator will not display the redundant entries but rather show each alias.host entry only once.
Is there any way to duplicate this using the REST API?
Thanks!
Rob,
Try adding "&expiry=0" to the URL, that should avoid the timeouts. I'm not sure why your query is causing a timeout even for samll time windows.
Hope that helps!
Rui