Velociraptor: the hunt id is not one client’s flow

One job, many flows

A hunt id names the request that was scheduled across clients. When a client finishes, that completion has its own flow id. The rows you download from one client are that flow. The hunt id does not by itself say which client’s file you opened.

A progress line such as “14 completed” is the hunt. It is not 14 copies of one flow, and it is not a single row count.

Cite the flow when you cite rows

If the note says “the process list,” name the flow id and the client id. Another client in the same hunt has a different flow and a different list. Adding those lists because they share a hunt id mixes two machines.

The hunt id still belongs on the note so someone can find the job. It is the parent. It is not a substitute for the flow.

What to file

File the hunt id, the flow id, the client id, and the row count for that flow. If you only have the hunt id, write “flow not recorded” and do not describe a specific client’s rows. Do not invent a flow id from the client’s place in the progress list.

Worked case: forty rows blamed on the hunt

Hunt H.lab9 completed on two lab clients. Flow F.100 on client C.111 has 40 process rows. Flow F.200 on client C.222 has 12. A draft says H.lab9 shows 40 processes and does not mention a flow.

The note quotes H.lab9 as the job, then F.100 with C.111 and 40, and F.200 with C.222 and 12. The 40 is not the hunt’s count. A reader who opens the other flow will not see those 40 rows.

hunt: H.lab9
flow F.100  client C.111  process rows: 40
flow F.200  client C.222  process rows: 12
write: the 40 belong to F.100
not: the hunt itself has 40 processes