Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/pages/en/dashboard_snapshots.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,12 @@ To create a new snapshot:

The snapshot is extracted from [Raw Capture](/en/v2/raw_capture) buffers and moved to dedicated storage on the Hub. The time window can span from minutes to days — limited only by how much raw capture data is available.

### Completion Status

Each worker node's data is copied to the Hub in parallel. If some nodes copy successfully while others fail, the snapshot finalizes as **Partially Completed** rather than being discarded — the captured data from the healthy nodes is kept. The status renders with an orange warning chip in the snapshots table, and each failed node shows its copy error.

A partially completed snapshot holds real captured data, so **PCAP** export and [Delayed Indexing](#delayed-indexing-optional) remain available for it, just like a fully completed snapshot. If every node fails, the snapshot is marked failed instead.

---

## PCAP Export
Expand Down
2 changes: 2 additions & 0 deletions src/pages/en/ui.md
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,8 @@ Hovering over UI elements with a green plus sign indicates they are queryable

The stream will be empty if [traffic indexing is disabled](/en/on_off_switch).

At very high dissection throughput, the live stream may fall behind and the Hub drops entries the UI cannot keep up with. When this happens, a warning chip appears in the traffic stats footer showing the drop rate — for example `{N}/s · {X}% not shown` — with a per-second breakdown in its tooltip. The indicator is visible only while entries are actively being dropped and refreshes on the Hub's heartbeat cadence, so it appears a few seconds into a sustained spike. Live view remains a complete sample as long as the chip is not shown; retrospective analysis over [snapshots](/en/v2/traffic_snapshots) is unaffected.

---

## KFL — Query Language
Expand Down