Filtering

The structure and use of filters in the Kentik Detect v3 portal is covered in the following topics:

• About Filters
• Filtering Options Dialog
• Filter Groups Interface
• Save Filter Dialog

Notes:
- For best performance, whenever possible use the Device selector (see Devices Pane UI) to choose devices rather filtering for devices.
- For information on managing saved filters, see Saved Filters.
- For filtering settings in the Kentik v4 portal see Filtering Settings.

In Kentik Detect, a filter allows you to narrow query results, either inclusively or exclusively, based on a value or range of values for one or more of the dozens of dimensions that represent the fields of the KDE main table (see About Dimensions). Individual filter conditions may be grouped, ANDed, ORed, and nested to create complex compound filters. In the underlying SQL for a given query, the specified filters are included in the WHERE clause.

Kentik Detect supports the following types of filters:

• Ad hoc filters: Settings are defined and applied using controls in the Filtering Options Dialog. For a list of locations in which the dialog is used (e.g. the Filtering pane of the Data Explorer sidebar) see Filtering Options Locations.
• Saved filters: Settings are called up from previously stored values. Includes both of the following:
  - Company filters: See Company Saved Filters.
  - Preset filters: See Preset Saved Filters.

Except when managing saved filters (see Saved Filter Admin Dialogs), filters are configured, saved, and applied in the Filtering Options dialog, which is covered in the following topics:

• Filtering Options UI
• Filtering Options Locations

Note: The controls of the filter groups in a Filtering Options dialog are covered in Filter Groups Interface.

The Filtering Options dialog includes the following UI elements:

• Close button: Click the X in the upper right corner to close the dialog without saving changes to the filter settings.
• Filter Groups pane: The primary control area for configuring, saving, and applying filters:
  - The main controls of the pane are covered in Filter Groups Interface.
  - The initial state of the pane is covered in Filter Groups Initial State.
• Cancel button: Close the dialog without saving changes. All elements will be restored to their values at the time the dialog was opened.
• Save button: Save changes to filter settings and exit the dialog.

The Filtering Options dialog is used in multiple portal locations to configure, save, and apply filters. The following table lists the locations in which the Filtering Options dialog is used, and indicates the presence/absence of controls that are not present in all locations (see Filtering Options Variations):

While the interface of the Filtering Options dialog is mostly the same wherever it appears, the following controls may not be present in some locations (see table above):

• Save Filters button: Opens the Save Filter dialog so that you can save your current filter configuration for later reuse.
• Add Saved Filter button: Opens a drop-down menu from which you can choose a saved filter (company or preset) to add to a filter group (existing or new, depending on button location).
• Add Nested Group button: Adds a new ad hoc filter group that is nested inside the current filter group.

The interface of the Filter Groups pane is covered in the following topics:

• About Filter Groups
• Filter Groups Initial State
• Filter Groups Controls
• Group-level Controls
• Ad Hoc Filter Controls
• Saved Filter Controls

Filters are configured within filter groups that enable flexible control over the ANDing and ORing of their component conditions. Each filter group may contain any combination (up to a maximum of 250) of ad hoc filters and saved filters (company or preset; see Filter Types); groups may also be nested within other groups.

Note: The filter groups interface described in the topics below is used to configure filter groups and their component filters, either in the Filtering Options Dialog or the Saved Filter Admin Dialogs.

The initial state of the Filter Groups pane occurs only if the Filtering Groups dialog is opened when there are no filters currently defined for the query. It does not occur in the Saved Filter Admin Dialogs.

In its initial state the Filter Groups pane contains the following two buttons:

• Add Ad Hoc Filter button: Adds a new filter group with the default dimension (e.g. Destination ASN) and unspecified value. The UI of an individual ad hoc filter is covered in Ad Hoc Filter Controls.
• Add Saved Filter button: Opens a drop-down menu from which you can choose a filter from a list of all available saved filters (company and preset). To find a specific filter, enter text from the filter’s name into the field at the top of the list. Once a saved filter is chosen from the list a new filter group will be added that contains the newly chosen filter. The UI of an individual saved filter is covered in Saved Filter Controls.

Once a user clicks either the Add Ad Hoc Filter or Add Saved Filter button in the initial Filter Groups pane the pane is populated with a single filter group containing a single filter of the corresponding type (ad hoc or saved). The pane may then be used to configure the filter and add filters and/or filter groups. The controls of a Filter Groups pane that’s no longer in its initial state are covered in the topics below:

• Filter Groups Controls: High-level controls for the entire current set of filter groups.
• Group-level Controls: Overall controls for one filter group, which may contain one or more individual filter conditions.
• Ad Hoc Filter Controls: Controls for applying and configuring an individual ad hoc filter, which defines one condition.
• Saved Filter Controls: Controls for applying a saved filter.

The following UI elements are high-level controls for the entire set of filter groups in the Filter Groups pane:

• Match selector (shown only when there are multiple filter groups): The drop-down match selector determines the conjunctive operator used to join all groups in the filter set:
  - All of the following groups (default) is used to AND the groups.
  - Any of the following groups is used to OR the groups.
• Save Filters: A button at upper right that opens the Save Filter Dialog so that you can save your current filter configuration for later reuse.
  Note: Not shown in all locations; see Filtering Options Locations.
• Remove All Groups: Removes all filter groups.
• Filter Groups: One or more filter groups with ad hoc filters and/or saved filters; see Group-level Controls.
• Add Filter Group buttons: Adds a new filter group to the set:
  - Add Ad Hoc Filter: Adds a new filter group with the default dimension (e.g. Destination ASN) and unspecified value.
  - Add Saved Filter: Opens a drop-down menu from which you can choose a filter from a list of all available saved filters (company and preset). To find a specific filter, enter text from the filter’s name into the field at the top of the list. Once a saved filter is chosen from the list a new filter group will be added that contains the newly chosen filter.
  Note: Not shown in all locations; see Filtering Options Locations.

A filter group is a container for one or more individual filters (conditions) or nested groups.

Each filter group includes the following controls:

• Include/Exclude: A drop-down selector that determines whether results that match the group are included or excluded from the results of queries to which the filter set is applied.
• All/Any: A drop-down selector that, if there are multiple filters in a filter group, determines the conjunctive operator used to join those filters:
  - All (default) is used to AND the filters.
  - Any is used to OR the filters.
• Remove Group: Removes the entire filter group.
• Filters: One or more of either of the following (up to a maximum of 250 total):
  - Ad Hoc Filter: See Ad Hoc Filter Controls.
  - Saved Filter: See Saved Filter Controls.
• Add Ad Hoc Filter button: Adds a new filter group with the default dimension (e.g. Destination ASN) and unspecified value. The UI of an individual ad hoc filter is covered in Ad Hoc Filter Controls.
• Add Saved Filter button: Opens a drop-down menu from which you can choose a filter from a list of all available saved filters (company and preset). To find a specific filter, enter text from the filter’s name into the field at the top of the list. Once a saved filter is chosen from the list a new filter group will be added that contains the newly chosen filter. The UI of an individual saved filter is covered in Saved Filter Controls.
  Note: Not shown in all locations; see Filtering Options Locations.
• Add Nested Group button: Add a new ad hoc filter group (rather than an individual filter condition) that is nested inside the current filter group (instead of at the same level as the current group). Nested filter groups enable you to create more complex filters. In the screenshot above, for example, the nested group based on source city matches on any of its conditions while the overall group matches on all conditions. This enables the query to look at all traffic from Russia except traffic from either Moscow or St. Petersburg.
  Note: Not shown in all locations; see Filtering Options Locations.

An individual ad hoc filter in a group defines one condition.

Each ad hoc filter includes the following controls:

• Dimension selector: Opens a dialog (see Dimension Selector Dialog) enabling you to choose the dimensions (see Dimensions Reference) on which to filter.
• Direction button: Appearing just to the right of any directional dimension, this button toggles the perspective of the dimension between source and destination.
• Operator: The operator to apply in the filter. Options, which vary depending on whether the dimension takes numeric or alphanumeric values, may include:
  - Equals, does not equal;
  - Greater than, less than;
  - Contains, does not contain (case insensitive);
  - Matches regex/does not match regex.
• Value: The value to match.
  Note: Leave the value undefined to include or exclude all records for which no value has been assigned to the filter dimension.
• Remove (X): Removes the filter from the group.

The dimension selector presents a list from which you can choose a dimension on which to filter. The dialog includes the following elements:

• Filter field: Filters the available dimensions to show only those whose name contains the entered text.
• Dimension lists: Lists of the available dimensions in each category, which are organized as described in Dimension Selection Groups.

When a filter group contains a saved filter (instead of or in addition to an ad hoc filter) the saved filter will include the following controls:

• Expand/Collapse (triangle icon): Shows or hides a saved filter detail, which is a read-only list of the filter groups and individual filters that make up the saved filter.
• Name: The name assigned to the filter when it was saved or edited.
• Description: The description text entered when the filter was saved or edited.
• Include/Exclude Results: A drop-down selector that determines whether results that match the saved filter are included or excluded from the results of the queries in which the filter is applied.
• Customize: Converts the saved filter into an ad hoc filter so that its filter groups and individual filters can be modified using the controls described in Ad Hoc Filter Controls.
• Filter details: A list of the individual filters (conditions) in the saved filter, as well as their associated logic for inclusion (include/exclude) and matching (any/all).

Once configured, a collection of filter groups can be saved for later reuse in the Filtering Options dialog via an Add Saved Filter button in the Filter Groups Controls or the Group-level Controls. The saved filter will be available to all other users in the organization and will be labeled as a company filter (see Company Saved Filters) in the Saved Filters List (Admin » Saved Filters).

To save a filter, open the Save Filter dialog by clicking the Save Filters button in the Filter Groups Controls. The dialog has the following fields:

• Filter name (required): A user-supplied name for the saved filter. The filter will not save if the entered value is already used as the name of a different saved filter.
• Filter description: User-supplied text that will display when the cursor hovers over the filter in the Saved Filters selection box.

After entering the filter name and description, click the Add Filter button to save the filter.

Note: To see a list of existing company filters, go to Admin » Saved Filters and click Company in the Share Level selector (see Saved Filters Page UI).