Well I agree with Josh, BUT, it all depends on your download speed. If you did everything from the UI, meaning you went to the Admin -> Hosts page, selected the NW server and from the Update menu, selected "Check for Updates", then when it said new updates are available you selected the 11.4.1 update version and the selected the NW server and then from the update menu, selected "Update Host", it could take some time. In some cases depending on the network latency and download speeds, it may even fail after a long period of time. See, when you ran the "Check for Updates", all that was downloaded was the latest repo manifest file, the actual repo files have not been downloaded yet. If you decide to use the automated download, when you run the "Update Host" on the NW server, the first thing it has to do is download the repo(s), in your case it will download the 11.4.1.0 repo, then realize it that the 11.4.0.0 repo is also needed, so will then download it also, these are 4.6 GB and 6.5 GB respectively, as the 11.4.0.0 is a dependency of the 11.4.1.0 repo, when it is trying to "configure" the 11.4.1.0, it has to download the 11.4.0.0 to do so. So the question is, how long will it take to download 11.1 GB on your network?
The workaround for this is to download the netwitness-11.4.0.0.zip file from my.rsa.com, and the netwitness-11.4.1.0.zip from RSA-Link ahead of time, the place them BOTH in the /var/netwitness/common/update-stage directory on the NW server (note: don't unzip them), then go to the Hosts page and run the "check for updates" and it will pop up a window stating that 11.4.1.0 is available and would you like to initialize it?, say yes, and the two repos 11.4.0.0 and 11.4.1.0 will be created from the zip files. THEN start your update of the NW server and it will kick off immediately.
