A server-implemented method for network monitoring, comprising: receiving network flow data represented as a plurality of data records describing operational data for a plurality of devices in a computer network; for each device in the plurality of devices: identifying a respective subset of a plurality of data servers for storing data records for that device; forwarding the data records for that device to the respective identified subset of the plurality of data servers, the subset of the plurality of data servers storing the data records for that device; recording metadata describing which data servers of the plurality of data servers are in the respective subset storing the data records for that device for an associated time period; receiving a query for at least a portion of the data records; dividing the received query into a plurality of subqueries, each subquery corresponding to a different device and time period associated with the received query; for each subquery of the plurality of subqueries: identifying, using the recorded metadata and responsive to the subquery, which data servers of the plurality of data servers store data records corresponding to the device and time periods specified by the subquery; transmitting the subquery to at least one of the identified data servers that are storing the data records corresponding to the device and time periods specified by the subquery; and receiving the data records corresponding to the device and time periods specified by the subquery from the at least one of the identified data servers. receiving network flow data represented as a plurality of data records describing operational data for a plurality of devices in a computer network; for each device in the plurality of devices: identifying a respective subset of a plurality of data servers for storing data records for that device; forwarding the data records for that device to the respective identified subset of the plurality of data servers, the subset of the plurality of data servers storing the data records for that device; recording metadata describing which data servers of the plurality of data servers are in the respective subset storing the data records for that device for an associated time period; identifying a respective subset of a plurality of data servers for storing data records for that device; forwarding the data records for that device to the respective identified subset of the plurality of data servers, the subset of the plurality of data servers storing the data records for that device; recording metadata describing which data servers of the plurality of data servers are in the respective subset storing the data records for that device for an associated time period; receiving a query for at least a portion of the data records; dividing the received query into a plurality of subqueries, each subquery corresponding to a different device and time period associated with the received query; for each subquery of the plurality of subqueries: identifying, using the recorded metadata and responsive to the subquery, which data servers of the plurality of data servers store data records corresponding to the device and time periods specified by the subquery; transmitting the subquery to at least one of the identified data servers that are storing the data records corresponding to the device and time periods specified by the subquery; and receiving the data records corresponding to the device and time periods specified by the subquery from the at least one of the identified data servers. identifying, using the recorded metadata and responsive to the subquery, which data servers of the plurality of data servers store data records corresponding to the device and time periods specified by the subquery; transmitting the subquery to at least one of the identified data servers that are storing the data records corresponding to the device and time periods specified by the subquery; and receiving the data records corresponding to the device and time periods specified by the subquery from the at least one of the identified data servers.