In this article:

Contents Search
   

 

Data Explorer

The features and use of the Data Explorer in the Kentik Detect portal are discussed in the following topics:

Note: The functionality of Data Explorer is also available via API; see V5 Query API.

 

 
 top

About Data Explorer

A general explanation of Data Explorer is provided in the following topics:

 

 
 top  |  section

Data Explorer Overview

Data Explorer is Kentik Detect’s primary interface for manually exploring the network data (flow records, BGP, SNMP, etc.) stored in the main tables of the Kentik Data Engine (KDE; see Main Table Schema). The Data Explorer UI enables you to define settings that are translated into queries that return “views” made up of tables and graphs about the traffic on specified devices during a specified timespan.

Views are defined using sidebar controls (see Explorer Sidebar Controls) to specify query parameters such as time range, devices, and dimensions, and to narrow the returned data by filtering on dozens of different main table fields. Views can be saved and reloaded at a later time (see About Saved Views).

Results are displayed in the display area and are typically made up of both of the following:

 

 
 top  |  section

Data Explorer Access

To open Data Explorer:

  • Default view: Click Data Explorer on the main portal navbar.
  • Saved view: Choose Saved Views from the Data Explorer menu in the main portal navbar, then click on the view that you want to open (see Loading a View).

 

 
 top  |  section

Data Explorer Areas

Data Explorer is made up of the following main areas:

  • Display area: An area for display of the current view, which in most cases is made up of a graph (see Data Explorer Chart) and an accompanying table (see Data Explorer Table).
  • Sidebar: An area at left that contains the controls (see Explorer Sidebar Controls) used to specify the query whose results are returned in the display area.

 

 
 top

Explorer Sidebar Controls

The Data Explorer sidebar contains the controls used to define the view whose query results are displayed in the chart and table in the Data Explorer display area. These controls are covered in the following topics:

 

 
 top  |  section

Explorer Sidebar Overview

The Data Explorer sidebar contains the following UI elements:

  • General controls:
    - Run Query button: Applies changed settings to the graph and table in the display area on the right side of Data Explorer (see Run Query Button).
    - Expand/Collapse control: Toggles the sidebar between expanded (panes) and collapsed (icons only) states (see Expand/Collapse Sidebar).
  • Sidebar panes: A set of panes that are used to set values for the queries whose results (typically graph and table) are shown in the display area at the right. The panes can be in either Edit mode or Summary mode (see Pane Display Modes).

Note: When the sidebar is collapsed its panes are represented by their respective icons.

 

 
 top  |  section

Explorer Sidebar Panes

In Data Explorer, the sidebar contains the following panes to control the query whose results are displayed in the display area:

  • Query pane: Specifies group-by, metric, and display by options, as well as additional advanced options; see Query Pane Settings.
  • Time pane: Specifies the time range covered by the query; see Time Pane Settings.
  • Filtering pane: Specifies filters that may be applied to the query; see Filtering Pane Settings.
  • Devices pane: Specifies the Kentik-registered devices covered by the query; see Devices Pane Settings.

Note: For additional general information about panes see About Sidebar Panes.

 

 
 top

Query Pane Settings

The Query pane contains a set of controls that define the general outlines of the query whose results are displayed in the graph and table in the Data Explorer display area. These controls are covered in the following topics:

 

 
 top  |  section

Query Basic Options

The Query pane includes the following basic query settings:

  • Group by Dimensions: A selection box used to choose one or more dimensions for the query that will be visualized in the Data Explorer display area. The chosen dimensions are included in the SELECT statement of the underlying query. The dimensions correspond to the fields of the KDE main table as described in Main Table Schema. To use the selection box, see Query Dimension Selectors.
  • CIDR: A pair of fields that appear only when the selected dimension includes a CIDR component (e.g. Source IP/CIDR):
    - v4 CIDR: Use to specify the number of bits of the routing prefix in IPv4. Default is 32.
    - v6 CIDR: Use to specify the number of bits of the routing prefix in IPv6. Default is 128.
    Note: If you have only v4 traffic, the v6 CIDR field will be ignored (can be left at 128).
  • Matrix With: A selection box that appears only when the View Type is set to Matrix (see Matrix View). This selection box, which is used to choose one or more matrix-with dimensions for a matrix query, functions identically to Group by Dimensions selection box as described in Query Dimension Selectors.
  • Metric: The units in which the graphs and table of the Data Explorer will express the results of the query. The available metrics vary depending on the types of devices covered by the query:
    - All devices: See General Metrics.
    - Host devices only: See Host Traffic Metrics.
  • PPS Threshold: This field appears if any hosts are selected in the Device List and Metric is set to Retransmits/s or % Retransmits. It filters the graph and table so that the only rows shown are those whose dimension value is at least the threshold value.
  • Display and Sort By: Sets the aggregate used to determine the top-x for calculating and ordering results in the graph and table:
    - Average: looks at the average value of the selected dimension over the specified timespan.
    - 95th Percentile: looks at the 95th percentile value of the selected dimension over the specified timespan.
    - Max (default): looks at the maximum value for the selected dimension during the specified timespan.

Note: Display and Sort By will be automatically set to Average when View Type (see Data Explorer Chart) is set to Pie Chart.

 

 
 top  |  section

Query Advanced Options

The Advanced Options control toggles display of additional Query pane settings. The following controls are visible only when advanced options are shown:

  • Total Overlay: Enables/disables plotting of the total traffic returned from the query. Total Overlay is not available if the View Type is set to Time Series Line Graph. For other view types the effect varies depending on type:
    - Time series stacked and bar graphs: Total appears in the graph as a blue line above the other plots.
    - Comparison bar chart: Total appears as blue line at right.
    - Pie chart: If total overlay is on, the chart includes a ring segment labeled “Other” (traffic not plotted ion the other segments); if off, the Other segment is not included.
    - Sankey diagram: If on, a row for total is included in the table below the diagram.
    - Matrix: If on, a total line will be plotted on the detail graphs that are rendered below the matrix when you click on a matrix cell, column heading, or row heading (depending on the view type selected for those graphs; see Matrix Detail Graph).
    Note: Turning off Total Overlay rescales the axis, which may improve your ability to see smaller-value plots.
  • Historical Overlay: Enables/disables plotting of the total from the same query run on a time range from a number of days earlier. Historical values are plotted as a dashed gray line. Historical Overlay is not available if the View Type is set to Time Series Line Graph, and is automatically switched off when the View Type is set to Pie Chart.
  • Days Back: If Historical Overlay is on, this field sets the number of days back that will be plotted in the historical display. For example, if the time range is last 6 hours, the time is 11:00, and the days back is set to 7 (default) then the historical plot will show the total from 5:00 to 11:00 seven days ago.
  • Reverse DNS Lookups: Determines whether reverse DNS (rDNS) lookup will be performed to determine associated domain names when querying IPs. Queries return faster when this option is off.
  • Bi-directional Charting (shown only if view type is stacked or line; see Chart View Types): Enables simultaneous charting of two graphs, one based on the current group-by dimensions and the other based on the opposite of those dimensions (see Compound Queries).
  • Secondary Metric (shown only if view type is stacked or line): Enables simultaneous charting of two metrics (see Compound Queries).
  • Flow sampled at: Determines which traffic will be included in the query:
    - Ingress: Includes all flow entering the devices.
    - Egress: Includes all flow exiting the devices.
    - Ingress + Egress: Includes all flow both entering and exiting the devices.
  • Dataseries: A drop-down menu to set the resolution of the KDE dataseries on which the query will be run, either Auto, Full, or Fast. See Resolution Overview.
  • Extract Function (shown only if at least one selected device is a host of type kprobe): Enables group-by on substrings in certain DNS/WWW dimension values; see DNS/WWW Extract Function.
  • Visualization depth: Determines how many rows, from 1-40, will be plotted in the graph. As this setting is increased, more detail is provided in the visualization, and there’s a decrease in the gap between the individual plotted data and the blue line representing Total.
    Note:
    When View Type is set to Table, the Visualization Depth determines how many rows will be displayed in the table.

 

 
 top  |  section

Query Dimension Selectors

The Query pane includes the following dimension selectors (pictured at right):

  • The Group By Dimensions selector, whose dimensions are chosen in the Group By Dimensions dialog.
  • The Matrix With selector, whose dimensions are chosen in the Matrix By Dimensions dialog. This selector appears only when the view type is Matrix (see Chart View Types).

Clicking in a dimension selector opens a dialog (see Query Dimension Dialogs) that allows you to choose multiple simultaneous group-by or matrix-with dimensions (see About Dimensions). Dozens of preset dimensions are currently available for traffic in groups including Source, Destination, Full (combined), and DNS/WWW (see Dimension Selection Groups). In addition, up to ten custom dimensions can be defined (customer-wide; see Custom Dimensions) and applied from a dimension selector.

Note: A query can use no more than eight group-by dimensions and eight matrix-with dimensions.

 

 
 top  |  section

Using Multiple Dimensions

The following example illustrates how multiple group-by dimensions combine to determine the results returned from a query. The example shows a common use case for multiple dimensions, which is when an organization that generates traffic wants to see where it’s going and which links and devices it’s using to get there (which enables you to see if the traffic is going to the expected geographic locations in the expected proportions):

  1. Using Query Basic Options, set Metric to Bits/s and choose Average for Display and Sort by.
  2. Use Time Pane Settings to set the timespan.
  3. Use Filtering Pane Settings to filter so that you are seeing only outbound traffic. (Assuming that Interface Classification shows that at least 75 percent of your interfaces are classified, the easiest way to do this is to set a Destination Network Boundary filter to External.)
  4. In the chart display settings (see Chart Display UI) set the View Type to Sankey Flow Diagram.
  5. Use Devices Pane Settings to select multiple devices.
  6. Use the Group-by Dimension selector to set following group-by dimensions:
    - Full: Device
    - Destination: Next Hop AS Number
    - Destination: AS Number
    - Destination: Region
    - Destination: Country
  7. After clicking the Run Query button, the graph and table will show traffic categorized by the specified dimensions.

In the results:

  • The Data Explorer Table will include a column for each dimension in the key (the five group-by dimensions specified above).
  • All traffic with the same dimension value for each component of the key will be measured in Mb/second and summed onto a single table row, meaning that each row will represent traffic that has the same device, same dst_next-hop-asn, same dst_as, same dst_region, and same dst_country.
  • The rows will be listed in descending order of highest average bits/second.
  • The Sankey diagram will show the paths of the traffic represented by the top table rows.

 

 
 top  |  section

Compound Queries

Compound queries enable the inclusion on a single chart of graphs resulting from multiple simultaneous underlying queries. Compound queries fall into two general categories, but in some cases (though not all) the categories can be applied simultaneously to create a chart incorporating four graphs:

  • Bidirectional: An “original” graph of traffic is based on the current Group-by Dimension setting, and an “opposite” graph is based on the opposite of those dimensions. For example, if the group-by dimensions are Source Country and Destination AS Number, the opposite graph would show traffic based on Destination Country and Source AS Number.
    Note: Filters are also flipped for the opposite view, meaning that filters on source in the original are on destination in the opposite, and vice versa.
  • Secondary Metric: A “primary” graph of traffic is based on the current Metric setting, and a “secondary” graph is based on the Secondary Metric setting.

As detailed in the table below, the results (graphs and tables) that are returned from a compound query depend on the interaction of several settings, including both Bi-directional Charting and Secondary Metric in the sidebar’s Query pane (see Query Advanced Options), and View Type in the chart display area (see Chart View Types).

View Type Secondary metric Bidirectional Chart axes Chart directions Table tabs
Stacked or Line None Off Left only Positive only Primary only
Stacked None On • Left: group-by dimensions
• Right: opposite dimensions
• Positive: group-by dimensions
• Negative: opposite dimensions
• Original: group-by dimensions
• Opposite: opposite dimensions
Stacked not None Off or On
Note: This setting is ignored unless Secondary Metric is None.
• Left: primary metric
• Right: secondary metric
• Positive: primary metric
• Negative: secondary metric
• Primary metric
• Secondary metric
Line None On Left only • Positive: group-by dimensions
• Negative: opposite dimensions
• Original: group-by dimensions
• Opposite: opposite dimensions
Line not None Off • Left: primary metric
• Right: secondary metric
Positive only • Primary metric
• Secondary metric
Line not None On • Left: primary metric
• Right: secondary metric
• Positive: group-by dimensions
• Negative: opposite dimensions
• Original group-by, primary metric
• Original group-by, secondary metric
• Opposite dimensions, primary metric
• Opposite dimensions, secondary metric

The following additional considerations apply when using compound queries:

  • In line charts, plots against the left axis are drawn with a solid line, while plots against the right axis are dashed.
  • On bidirectional charts, the flipping of dimensions (e.g. from Source ASN to Destination ASn) for opposite graphs applies only to dimensions in the Source and Destination groups (see Dimension Selection Groups). Dimensions in the Full and DNS/WWW categories are treated the same on both original and opposite graphs.
  • Dimensions in the Custom category (see Custom Dimensions) will be flipped only if there are two dimensions whose names are identical except in one of the following ways:
    - One includes “src” where the other has “dst.”
    - One includes “in” where the other has “out.”
    - One includes “to” where the other has “from.”

Note: Compound queries are currently a Beta feature.

 

 
 top  |  section

DNS/WWW Extract Function

The dimensions available in the Group By Dimension selector vary depending on the device type. If any device currently selected in the Devices pane (see Devices Pane Settings) is a host of type kprobe (see Host Configuration) the dimension selector will include a set of DNS/WWW dimensions (see Host Traffic Dimensions).

Some of these DNS/WWW dimensions will, when selected, result in the addition of Extract settings to the Advanced Options portion of the Query pane. The Extract settings are available for the following dimensions:

  • DNS Query
  • HTTP URL
  • HTTP Host Header

The Extract settings change how Kentik evaluates the values that are stored in the KDE main table column (see Main Table Schema) that corresponds to a dimension listed above:

  • With no extraction, each unique value in the column will be treated separately.
  • With extraction, a regex-defined pattern will be used to look for matching substrings within the values, and all values that match the same substring will be grouped together.

In a query that returns Top-X ranking, for example, if the dimension is DNS Query and the extract function is set to Domain then instead of counting each subdomain within a domain (e.g. x.domain.com, y.domain.com, and z.domain.com) as a unique value, all values sharing the same domain will be counted together.

To apply the extract function, use the Extract settings to choose (from the drop-down menu) the type of substring that you want to match. The Regex and Selector fields will then be populated with the suggested POSIX-style regex (shown in the following table) and selector for that type of match. Because the fields are editable, you can customize the regex as needed to achieve the desired result.

Substring type Regex:
DNS Query,
HTTP Host Header
Regex:
HTTP URL
TLD [^.]+\.([^.]+)$ N.A.
Domain ([^.]+\.[^.]+)$ N.A.
Subdomain ([^.]+\.[^.]+\.[^.]+)$ N.A.
Host (^.*)\.[^.]+\.[^.]+$ N.A.
Path N.A. (^.*)/.*(\?)+
Filename N.A. ^.*(/.*)(\?)+
File Path N.A. (^.*)(\?)+
Query String N.A. ^.*[\?]+(.*)

Note: For additional information on or assistance with using the extract function, please contact support@kentik.com.

 

 
 top

Query Dimension Dialogs

The Group By Dimensions and Matrix By Dimensions dialogs are used to choose dimensions for the Group By Dimensions selector and Matrix With selector, respectively. These query dimension dialogs are covered in the following topics:

Note: A query can use no more than eight group-by dimensions and eight matrix-with dimensions.

 

 
 top  |  section

Dimension Dialog UI

The query dimension dialogs share the following common UI elements:

  • Close button: Click the X in the upper right corner to close the dialog. All elements will be restored to their values at the time the dialog was opened.
  • Clear Selections button: Clears all dimensions from the Selected Dimensions list.
  • Filter field: Filters the list of available dimensions to those containing the entered text.
  • Selected Dimensions list: A list of selected dimensions (up to eight). Use the handle at the left of each selected dimension to change the order in which the dimensions are applied.
  • Available dimensions list: A list of all of the dimensions that are currently supported by Kentik Detect, listed by group (see Dimension Selection Groups).
  • Cancel button: Cancel changes to the selected dimensions and exit the dialog. The current query’s dimensions will be restored to what they were when the dialog was opened.
  • Save button: Save changes to the selected dimensions and exit the dialog.

 

 
 top  |  section

Dimension Selection Groups

The dimensions available in the query dimension selectors are based on the columns of the main tables of the KDE (see Main Table Schema), which each represent a minute of flow records for a given device. The types of dimensions available for querying are discussed in Dimension Categories.

In the Query pane dimension selectors (as well as in the dimension selector for filters; see Filter Controls), the available dimensions are organized into the following groups:

  • Source: Source traffic.
  • Destination: Destination traffic.
  • Source or Destination (Filter pane only): Matches on either source or destination traffic (saves adding two filters).
  • Full: Non-directional dimensions.
  • DNS/WWW: Dimensions related to DNS lookup and HTTP.
  • Custom: See Custom Dimensions.

 

 
 top  |  section

Choosing Query Dimensions

To choose dimensions for the Group By Dimensions selector or Matrix With selector:

  1. By default (e.g. when you first navigate to the Data Explorer), the Group by Dimensions box is populated with a single dimension (e.g. Destination ASN). Click in the.
  2. Click in the selection box. A menu appears listing all available dimensions, categorized into Source, Destination, Full (all traffic), and Custom.
  3. Click on a dimension to add it to the selection box.
  4. Repeat the previous steps to add additional dimensions.
  5. To change the order in which the dimensions are applied, drag the dimensions into the desired order.

Notes:
- When more than one group-by dimension is selected the combination of dimensions is evaluated together to determine the rows that are included in the results; see Using Multiple Dimensions.
- Dimensions in the category DNS/WWW (see Dimension Categories) will only appear in the selector if one or more device currently selected in the Devices Pane (see Devices Pane Settings) is a host of type DNS/WWW (see Host Configuration).
- The Matrix With selection box operates the same as the Group By Dimension selection box. For more information, see Matrix View.

 

 
 top

Explorer Chart Display

The chart display area is used to display a visualization of the results of the current query as a time-series graph and a table. The display area is covered in the following topics:

 

 
 top  |  section

Chart Display UI

The chart display area contains a number of UI elements in addition to the visualization (chart) itself, some of which are above the chart and others below.

The following elements are found above the chart:

  • Query title: The name for the query whose visualization is displayed in the display area. The name is refreshed each time changes to the query are applied with the Run Query button at the top of the sidebar.
  • Save View button: Opens the Add Saved View dialog (see Saved Views).
  • Pivot: Opens the Pivot dashboard (in a separate window or tab) and presents the traffic represented in the chart within a set of dashboard panels showing different views of the underlying data, such as source and destination IP, port, ASN, country, and devices.
    Note: To see a Pivot dashboard for an individual table row (see Data Explorer Table) rather than for all returned results, click Pivot on the action menu at the right of that row (see Explorer Table Actions).
  • View Type: A drop-down menu used to set the type of visualization to display in the display area; for a list of the options see Chart View Types.
  • Refresh: Updates the currently displayed graph and table. The graph and table will only change if the query is set to a relative timespan (Lookback).
  • Options menu:
    - Add to Dashboard: Opens a dialog allowing the current Data Explorer settings to be displayed as a panel on the dashboard. See Add View to Dashboard.
    - Export: Exports the information represented by the display area’s graphic to a file, either a graphic image or table data. See Export Chart or Table.
    - View SQL: A nested menu used to go to the Query Editor, where the SQL Query field will be populated with the query for this panel.
    - Show API Call: Provides access to the query API dialogs (see Show API Call), which contain cURL and JSON that can be used to return the current content of the display area from the Kentik Query API. The code in the dialogs can be copied and pasted to enable programmatic access to Kentik Detect.
    - Share View: Provides access to the Share Explorer View, which contains a URL for the current view in the data display area that can be copied and shared.

The following elements are located below the chart:

  • Last Updated indicator: The date-time at which the query represented in the chart was most recently run.
  • Live Update/Stop Updating: Toggles the query in and out of Live Update Mode. The control changes depending on the current mode:
    - Live Update: When the query is not in Live Update mode, the control is a drop-down menu for selecting the interval (60, 90, or 120 seconds) for live updating.
    - Stop Updating: When the query is in Live Update mode, the control is a button that stops live updating.
    Note: Live Update mode is only available when the Time pane is set to Lookback (see Time Pane Settings).
  • Sync Axes (only when Bi-directional Charting is on or Secondary Metric is not None): Sets the scale of both left and right axes to the same numeric values (even if the metric is different).
    Note: The greater the difference in value between the scale of the two axes, the greater the likelihood that syncing the axes will effectively hide data plotted against the lower-value axis.

 

 
 top  |  section

Data Explorer Chart

The Data Explorer chart is a visualization based on traffic whose flow records are stored in the Kentik Data Engine (KDE). Most (but not all; see Chart View Types) of these visualizations are based on the top records returned from the current query, as measured by the metric selected in the Query pane (see Query Basic Options). Many are based on time-series data, plotted over a time range (see Time Pane Settings) represented on the horizontal axis, with the metric represented on the vertical axis.

Each plot in the visualization corresponds to a row in the table that appears under the chart (see Data Explorer Table). The number of table rows plotted in the chart depends on the visualization depth (see Query Advanced Options). Each plotted row is indicated in the table with a colored disc.

The chart in the display area is dynamic:

  • Hover over any line in a line chart or area upper boundary in a time series stacked graph to see a popup containing data for a specific record at a specific point in time.
  • Drag and release in the chart to select a portion of the time range to zoom in on. When zooming:
    - the Time pane is automatically set to From + To with the start and end times defined based on the zoomed region;
    - the graph and table in the display area, along with its associated URL, update so that the zoomed range can be shared; and
    - a Zoom out button appears at the upper right of the graph, which can be clicked to zoom out to the previous time range.
  • Clicking on the colored disc at the left of any row in the table will hide the area or line corresponding to that row from the chart. The disc will turn into a circle. Click the circle to restore display of the line or area in the chart.

 

 
 top  |  section

Chart View Types

The type of graph rendered in the display area is set with the View Type drop-down menu in the Display pane (see Chart Display UI). The following chart types are currently supported:

  • Time Series Stacked Graph (default): The top rows in the returned data are plotted over the specified time range, showing the contribution of each row to the combined total.
  • Time Series 100% Stacked Graph: Like a standard stacked graph, but with each row shown as a percentage of the total traffic returned from the query.
  • Time Series Bar Graph: The top rows in the returned data are plotted over the specified time range, showing the contribution of each row to the combined total. The duration represented by each bar is determined by the query’s aggregation step boundaries, which vary depending on the width of the query timespan as described in Time Rounding.
  • Time Series Line Graph: The top rows in the returned data are plotted over the specified time range, with the values overlapping rather than stacked. The combined total is not plotted.
  • Comparison Bart Chart: The top rows in the returned data are plotted as individual bars against a horizontal axis representing the metric being counted. The combined total is plotted.
  • Pie Chart: The top rows are each shown individually as a colored segment of the pie, with the sum of all other rows shown together as “Other.”
  • Sankey Flow Diagram: A diagram of network traffic in which the dimensions are represented by colored vertical bars and the width of the gray bands between the bars is proportional to the quantity of traffic in common between those dimensions.
  • Table: The table alone is displayed without a graph or chart in the data display area. In this mode, the table can be exported (see Export Chart or Table) or added to a dashboard (see Add View to Dashboard).
  • Matrix Diagram: A table with a vertical axis of top group-by dimensions, a horizontal axis of matrix-with dimensions, and cells showing traffic in the current metric (see Matrix View).

Notes:
- The number of “top rows” in the descriptions above varies depending on the Visualization Depth (see Query Advanced Options).
- If the view type is set to Pie Chart then when the query is run Display and Sort By will be automatically set to Average and Historical Overlay (see Query Advanced Options) will, if on, result in a Historical Total row in the Data Explorer Table but not in the display of historical data on the pie chart.
- The Sankey view type requires multiple group-by dimensions (see Query Dimension Selectors).
- If Historical Overlay is on then historical values are plotted on the chart as a dashed gray line.

 

 
 top  |  section

Matrix View

When the view type is set to Matrix (see Chart View Types), the display area will show a matrix, which is a table in which:

  • The vertical axis (rows) represents the currently chosen group-by dimensions.
  • The horizontal axis (columns) represents the currently chosen matrix-with dimensions.
  • The values in the cells are expressed in the currently set metric.
  • The number of rows/columns is determined by the Visualization depth setting (see Query Advanced Options), with an upper limit of 15.

 

Matrix View Queries

The table in a matrix view is populated (behind the scenes) using three successive queries (where X represents the visualization depth):

  1. Get the top-X instances, measured by current metric (e.g. average pkts/sec), of the currently chosen group-by dimension (e.g. Src cities) across all currently selected devices. These become the rows of the matrix.
  2. Get the top-X instances, measured by current metric, of the currently chosen matrix-with dimensions (e.g. Dst cities) across all currently selected devices and filtered to include only the results of the first query. This becomes horizontal axis (columns).
  3. Get the traffic volume, in currently selected metric, between the group-by and matrix-with dimensions at each row/column intersection. These values populate the corresponding cells of the matrix.

Notes:
- A matrix may include multiple group-by and/or matrix-with dimensions.
- In addition to the filtering described in query 2 above, all other filters specified in the Filters pane of the sidebar will also be applied to the queries.
- Variations in cell background color correspond to the scale at the right of the matrix itself.

 

Matrix View Example

In the following example, the metric is packets/second, Visualization depth is set to 8, and Display and Sort By is Average. The group-by dimension is Source: City and the matrix-with dimension is Destination: City, so the vertical axis shows the top 8 source cities as measured in average packets/second, and the horizontal axis shows the top 8 destination cities filtered by the source cities. The cells of the table are populated with average packets/second between the cities on the two axes.

 

Using Matrix View

To use the Matrix view type:

  1. Use the Group-by Dimensions selection box to choose one or more dimensions for the rows in the Matrix table (see Query Dimension Selectors and Using Multiple Dimensions).
  2. Set the view type to Matrix (see Chart Display UI). The Matrix-by Dimensions dialog opens (see Query Dimension Selectors).
  3. Use the dialog to select one or more dimensions for the columns in the Matrix table, then click the Matrix by Selected Dimensions button. The Matrix With selector appears in the Query pane of the sidebar.
  4. Set the remaining query options in the Query pane as well as the Time, Filters, and Devices panes.
  5. Click the Run Query button. The matrix will appear in the display area.

 

Matrix Detail Graph

Once the matrix is rendered, you can click an individual cell to open a pop-up with a visualization of the corresponding data. You can select an alternate view type from the drop-down View Type menu at the upper right of the graph, and you can save the graph as a Saved View with the Save View button.

The following example shows a detail graph of the Los Angeles row of a matrix, rendered with a view type of Sankey diagram.

Notes:
- When creating a detail graph from an individual cell, don’t click directly on the cell value (a Highcharts bug prevents the click from being recognized).
- The view type setting for a detail graph is sticky until the overall matrix is reset by applying sidebar changes, at which point detail graphs will once again be rendered using the default view type.
- The effect of the Total Overlay switch on a detail graph depends on view type (see Chart Display UI).

 

 
 top  |  section

Live Update Mode

Live Update mode allows you to optionally set an interval — 60, 90, or 120 seconds — at which the Data Explorer will automatically refresh the graph and table. The countdown to refresh starts over each time you apply changes and the new result is returned in the display area. To enter Live Update, choose the desired update interval from the drop-down Live Update menu (see Chart Display UI). To leave, click the Stop Updating button.

Notes:
- Live Update mode is only available when the sidebar’s Time pane was set to Lookback when the Run Query button was most recently clicked (see Time Pane Settings).
- Unless the Time pane is set to Lookback when you click Run Query, Data Explorer will automatically exit Live Update mode.

 

 
 top

Data Explorer Table

The query results displayed as a visualization in the chart display area are also presented as a table, which is covered in the following topics:

 

 
 top  |  section

Explorer Table Overview

The Data Explorer table lists (in descending order) the values of selected metrics for the results returned from the current query. The last row (at bottom) will show the combined total of all records returned from the query. The table rows that are marked with a colored disc at left are those that are plotted in the chart above (the number of plotted rows is determined by the Visualization Depth setting; see Query Advanced Options).

The location in which the table is displayed depends on the current view type (see Chart View Types):

  • When the view type is a graph or chart, the table is shown below the chart display area (see Explorer Chart Display).
  • When the view type is set to Table, the table alone is displayed without a graph or chart. In this mode, the table can be exported (see Export Chart or Table) or added to a dashboard (see Add View to Dashboard).
  • The table is not shown when the view type is Matrix.

Note: When displaying results from a compound query (see Compound Queries), multiple tables are used, each on a separate tab corresponding to one axis (left/right) and/or direction (positive/negative).

 

 
 top  |  section

Explorer Table Columns

The left-most columns of the table always correspond to the dimensions selected in the Query pane (see Query Pane Settings).

The other columns depend on the setting of the Metric drop-down menu in the Query pane and whether the selected device(s) are routers only or also include hosts (see Devices Pane Settings):

Metric Router only Host only or both router and host
Bits/s - Avg Mb/sec
- 95th Percentile
- Max Mb/sec
- Last Datapoint
In:
- Avg Mb/sec
- 95th Percentile
- Max Mb/sec
- Last Datapoint
Out:
- Avg Mb/sec
- 95th Percentile
- Max Mb/sec
- Last Datapoint
In+Out:
- Avg Mb/sec
Packets/s - Avg pps
- 95th Percentile
- Max pps
- Last Datapoint
In:
- Avg pps
- 95th Percentile
- Max pps
- Last Datapoint
Out:
- Avg pps
- 95th Percentile
- Max pps
- Last Datapoint
In+Out:
- Avg pps
Retransmits/s N.A. Retransmits/s:
- Avg/sec
- 95th percentile
- Max/sec
- Last Datapoint
% Retransmits:
- Avg
- 95th percentile
- Max
- Last Datapoint
Traffic:
- Max mbps Sent
- Avg mbps Sent
- Avg pkts/s Sent
% Retransmits N.A. Retransmits/s:
- Avg/sec
- 95th percentile
- Max/sec
- Last Datapoint
% Retransmits:
- Avg
- 95th percentile
- Max
- Last Datapoint
Traffic:
- Max mbps Sent
- Avg mbps Sent
- Avg pkts/s Sent
Count/s - Avg fps
- p95th fps
- Max fps
- Last Datapoint
- p95th mbps
- p95th pps
- Avg fps
- p95th fps
- Max fps
- Last Datapoint
- p95th mbps
- p95th pps
Unique Src IPs - Max IPs per Device
- Last Datapoint
- p95th mbps
- p95th pps
- Max IPs per Device
- Last Datapoint
- p95th mbps
- p95th pps
Unique Dst IPs - Max IPs per Device
- Last Datapoint
- p95th mbps
- p95th pps
- Max IPs per Device
- Last Datapoint
- p95th mbps
- p95th pps

Notes:
- The table will include a row (at bottom) for the combined total of all records returned from the query if either of the following is true:
(a) the view type (see Chart View Types) is not Time Series Line Graph;
(b) the view type is line graph and the only group-by dimension is Full:Total.
- If the table includes a row for total, you can also turn on Historical Overlay to include a row for historical values.
- The Last Datapoint column gives the value of the datapoint at the end of the time series represented in the chart/table.

 

 
 top  |  section

Explorer Table Actions

A number of actions can be taken in the table to change the display of information in the table and also the corresponding chart (see Data Explorer Chart):

  • Hide/show row: Clicking on the colored disc at the left of a given row will hide the area or line corresponding to that row from the chart, and the disc will turn into a circle. Click the circle to restore display of the line or area in the chart.
  • Pivot: Choosing Pivot from the Action menu at the right of each table row opens a Pivot dashboard that is filtered based on the values of the row’s dimension columns. The dashboard presents the traffic represented in the row within a set of dashboard panels showing different views of the underlying data, such as source and destination IP, port, ASN, country, and devices.
    Note: To see a Pivot dashboard for the traffic in the entire table rather than for an individual row, click the Pivot link above the chart (see Chart Display UI).
  • Add filter to query: Choosing Include or Exclude from the Action menu will create filters in the Filtering pane corresponding to the values in the row’s dimension columns. The filters will be applied when you click the Run Query button. The operator used for the filter depends on the dimensions currently selected in the Query pane:
    - for Include the filter will use either the = or LIKE operator;
    - for Exclude the filter will use either the <> or NOT LIKE operator. When the changes are applied, the row will be excluded from the chart.
  • Add filter and change dimension: Choosing Show by from the Action menu at the right of each table row results in two combined actions:
    - adds an “include” filter as described in “Add filter to query” above;
    - opens a Show By Dimension dialog that is identical to the Group By Dimension selector described in Query Dimension Selectors. The dimensions selected in this dialog will replace the dimensions previously shown in the Query pane, and will be applied when you click the Run Query button.

 

 
 top

Explorer View Options

The queries created and displayed in Data Explorer can be saved to a panel in the Dashboard or shared with other Kentik Detect users. The dialogs related to these capabilities are covered in the following topics:

 

 
 top  |  section

Add View to Dashboard

The Add to Dashboard dialog enables you to choose a new or existing dashboard to which you can save a panel whose view corresponds to the current view in Data Explorer. The procedure for adding a Data Explorer view to a dashboard panel is covered in Add Panel from Explorer.

 

 
 top  |  section

Export Chart or Table

Choosing Export from the Title pane’s Options menu allows you to export to a file the information represented by the graphic in the display area. The information can be exported either as chart, a table, or both; available file formats depend on the choice of output:

  • Chart only: PNG, SVG, or CSV.
  • Chart + Table: PDF.
  • Table only: CSV.

After you choose the file format, you’ll see a notification explaining that the file is being prepared. When the file is ready another notification will give the link for downloading the file.

Note: When exporting CSV from a compound query (see Compound Queries) you will be able to choose which axis (see Compound Queries) to include in the data that is output to the file.

 

 
 top  |  section

Show API Call

The Show API Call item on the Options menu (see Chart Display UI) provides access to a set of dialogs that contain code (cURL or JSON) that can be used to return the current view (content of the display area) from the Kentik Query API. The code in these dialogs can be copied and pasted to enable access to Kentik Detect programmatically rather than via the portal.

Query API code is accessed via the following dialogs, which each display code in a text field from which it can be copied either manually or using the Copy to Clipboard button:

  • For Chart (cURL): Opens a dialog containing the cURL for returning an image of the Data Explorer’s current chart from a CLI such as Terminal. Equivalent to the Query Chart Method of the Kentik Query API.
  • For Data (cURL): Opens a dialog containing the cURL for returning the Data Explorer’s current table from a CLI such as Terminal. Equivalent to the Query Data Method of the Kentik Query API.
  • JSON Input: Opens a dialog containing JSON that can be used in the Query Data Method.

When using the cURL, the following placeholders must be replaced with the appropriate information:

  • Replace <YOUR_EMAIL_HERE> with the email address used to register you as a Kentik Detect user.
  • Replace <YOUR_API_TOKEN_HERE> with your API token, which you’ll find on your User Profile Page.
  • If the cURL is for a chart, replace <CHOOSE ONE OF:pdf|png> with the desired file type.

 

 
 top  |  section

Share Explorer View

The Share View dialog provides a URL that you can send to another registered user within your organization. By navigating to the link (e.g. pasting the URL into the address bar of their browser) they will be able to see the Data Explorer’s current view in their own instance of Kentik Detect.

To get a view URL to share, choose Share View from the display area’s Options menu (see Chart Display UI). The Share View dialog will open, with the link shown in the text field. Click the Copy to Clipboard button to copy the link to the clipboard so you can paste it into a message or email to another member of your organization.