AnsweredAssumed Answered

Esper Named Windows - Do they survive stopping and starting the ESA Service

Question asked by David Waugh on Sep 12, 2017
Latest reply on Oct 9, 2017 by David Waugh

Hello

 

I am trying to implement

Trend Analysis with the Netwitness Suite 

 

but we have a backup job that stops the ESA Service every night, takes a backup and then restarts the service.

 

I thought that having @RSAPersist in the windows eg:

 

CREATE WINDOW baselineEvery5MinutesData.win:time(60 minutes) (metaKey string, metaValue string, eventCount long);
@RSAPersist
CREATE WINDOW baselineEvery1HourData.win:time(30 days) (metaKey string, metaValue string, eventCount long, timeframe string);
@RSAPersist
CREATE WINDOW baselineEvery1DayData.win:time(30 days) (metaKey string, metaValue string, eventCount long, timeframe string);
/* data structure to store the baseline statistics. The last stat only is kept and is updated at each iteration */
@RSAPersist

 

 

 

Would mean that when the ESA service stopped the last snapshot of data would be saved and reused again when starting up.

 

However, when I look in my named windows before and after stopping the service, then the results are different.

 

 

Can anyone confirm if named windows contents ado persist between service restarts?

 

I am using 10.6.4.1

Outcomes