Abstract: A method includes receiving, by a distribution server, from an exporter device, a plurality of network traffic records. The method includes generating, by the distribution server, a first hash from a first plurality of fields in a first of the plurality of network traffic records and generating a second hash from a second plurality of fields in a second of the plurality of network traffic records. The method includes comparing the first hash and the second hash and determining that the first of the plurality of network traffic records and the second of the plurality of network traffic records relate to a session, based upon the comparison. The method includes transmitting the first and second of the plurality of network traffic records to one of a plurality of worker computing devices selected based on the determination and on at least one of the first and second hash.