View Events for Elephant Flows

After configuring your elephant flow settings, monitor your connection events to see if any flows are detected, bypassed, or throttled. You can see this information in the Reason field of your connection events. The three types for elephant flow connections are:

  • Elephant Flow

  • Elephant Flow Throttled

  • Elephant Flow Trusted

Procedure

Step 1

Choose Analysis > Connections > Events. You can also view the events from the Unified Events viewer.

Step 2

In the Connection Events page, from the Predefined Search drop-down list, choose Elephant Flows to display elephant flow events.

Tip

To see Elephant Flow Trusted or Elephant Flow Throttled event types, click the Edit Search link on the top-left corner of the page and in the Reason field, choose Elephant Flows in the left panel. Enter Elephant Flow Trusted or Elephant Flow Throttled, depending on what you want to search.

Step 3

View the elephant flow that was detected mid-flow and the Reason field shows Elephant Flow. At the end of the flow, it was bypassed and the Reason field shows Elephant Flow Trusted.