Filters Settings

This article covers filters settings in queries for Data Explorer and dashboard panels in the Kentik portal.

Notes:

• For best performance, whenever possible use the Device selector (see Data Sources Pane) to choose devices rather than filtering for devices.

• For information on managing saved filters, see Saved Filters.

About Filters

In Kentik’s Data Explorer and dashboard panels, a filter allows you to narrow query results inclusively/exclusively based on a value (or range of values) for one or more dimensions (see About Dimensions). Individual filter conditions may be grouped, ANDed, ORed, and nested to create complex compound filters.

Filter Types

Kentik supports the following types of filters:

• Ad hoc filters: Settings are defined and applied using controls in the Filters Dialog. For a list of locations in which the dialog is used (e.g., the Filters pane of the Data Explorer sidebar) see Filters Dialog Locations.

• Saved filters: Settings are called up from previously stored values. Includes both of the following:

  • Company filters: See Company Saved Filters.

  • Preset filters: See Preset Saved Filters.

Filters Pane

The Filters pane appears in the sidebar in Data Explorer and in dashboards as well as in the settings dialog for the individual panels on dashboards. The pane includes the following UI elements:

• Filter Groups: A list of the filter groups that are currently applied to the query:

  • When no filters are selected, the list is replaced with "No filters applied."

  • An individual filter group in the list can be removed by clicking the X at right.

• Edit Filters: A button that opens the Filters Dialog.

Filters Dialog

Except when managing saved filters (see Saved Filter Admin Dialogs), filters are configured in the Filters dialog.

Note: The filter groups controls in the Filters dialog are covered in Filter Groups Interface.

Filters Dialog UI

The Filters dialog UI includes the following elements:

• Close button: Click the X in the upper right corner to close the dialog without saving changes to the filter settings.

• Filter Groups pane: The primary control area for configuring, saving, and applying filters:

  • The main controls of the pane are covered in Filter Groups Interface.

  • The initial state of the pane is covered in Filter Groups Initial State.

• Cancel button: Close the dialog without saving changes.

• Save button: Save changes to filter settings and exit the dialog.

Filters Dialog Locations

The Filters dialog is used in multiple portal locations to configure filters.

Note: The table also indicates the absence of certain controls in certain portal sections.

Filter Groups Interface

Filters are configured within Filter Groups, enabling flexible control over the ANDing and ORing of their component conditions. Filter groups can:

• Be configured either in the Filters Dialog or the Saved Filter Admin Dialogs.

• Contain up to 250 ad hoc or saved filters (company or preset, see Filter Types).

• Be nested within other filter groups.

Filter Groups Initial State

The initial state of the Filter Groups pane occurs only if the Filtering Groups dialog is opened when there are no filters currently defined for the query. It does not occur in the Saved Filter Admin Dialogs.

In its initial state the Filter Groups pane contains the following two buttons:

• Add Ad Hoc Filter: Adds a new filter group with the default dimension (e.g., Destination ASN) and unspecified value (see Ad Hoc Filter Controls).

• Add Saved Filter: Opens a drop-down menu from which you can choose a filter from a list of all available saved filters (company and preset). To find a specific filter, enter text from the filter's name into the field at the top of the list. Once a saved filter is chosen from the list a new filter group will be added that contains the newly chosen filter. The UI of an individual saved filter is covered in Saved Filter Controls.

Once a user clicks either the Add Ad Hoc Filter or Add Saved Filter button in the initial Filter Groups pane the pane is populated with a single filter group containing a single filter of the corresponding type (ad hoc or saved). The pane may then be used to configure the filter and add filters and/or filter groups. The controls of a Filter Groups pane that's no longer in its initial state are covered in the topics below:

• Filter Groups Controls: High-level controls for the entire current set of filter groups.

• Group-level Controls: Overall controls for one filter group, which may contain one or more individual filter conditions.

• Ad Hoc Filter Controls: Controls for applying and configuring an individual ad hoc filter, which defines one condition.

• Saved Filter Controls: Controls for applying a saved filter.

Filter Groups Controls

The following UI elements are high-level controls for the entire set of filter groups in the Filter Groups pane:

• Match selector (shown only when there are multiple filter groups): The drop-down match selector determines the conjunctive operator used to join all groups in the filter set:

  • All of the following groups (default) is used to AND the groups.

  • Any of the following groups is used to OR the groups.

• Save Filters: A button at upper right that opens the Save Filter Dialog so that you can save your current filter configuration for later reuse.

  Note: Not shown in all locations (see Filters Dialog Locations).

• Remove All Groups: Removes all filter groups.

• Filter Groups: One or more filter groups with ad hoc filters and/or saved filters; see Group-level Controls.

• Add Filter Group buttons: Adds a new filter group to the set:

  • Add Ad Hoc Filter: Adds a new filter group with the default dimension (e.g., Destination ASN) and unspecified value.

  • Add Saved Filter: Opens a drop-down menu from which you can choose a filter from a list of all available saved filters (company and preset). To find a specific filter, enter text from the filter's name into the field at the top of the list. Once a saved filter is chosen from the list a new filter group will be added that contains the newly chosen filter.

  Note: Not shown in all locations (see Filters Dialog Locations).

Group-level Controls

A filter group is a container for one or more individual filters (conditions) or nested groups.

Each filter group includes the following controls:

• Include/Exclude: A drop-down selector that determines whether results that match the group are included or excluded from the results of queries to which the filter set is applied.

• All/Any: A drop-down selector that, if there are multiple filters in a filter group, determines the conjunctive operator used to join those filters:

  • All: (default) Select to AND the filters.

  • Any: Select to OR the filters.

• Remove Group: Removes the entire filter group.

• Filters: One or more of either of the following (up to a maximum of 250 total):

  • Ad Hoc Filter: See Ad Hoc Filter Controls.

  • Saved Filter: See Saved Filter Controls.

• Add Ad Hoc Filter (button): Adds a new filter group with the default dimension (e.g., Destination ASN) and unspecified value. The UI of an individual ad hoc filter is covered in Ad Hoc Filter Controls.

• Add Saved Filter (button): Opens a drop-down menu from which you can choose a filter from a list of all available saved filters (company and preset). To find a specific filter, enter text from the filter's name into the field at the top of the list. Once a saved filter is chosen from the list a new filter group will be added that contains the newly chosen filter. The UI of an individual saved filter is covered in Saved Filter Controls.

  Note: Not shown in all locations (see Filters Dialog Locations).

• Add Nested Group (button): Add a new ad hoc filter group (rather than an individual filter condition) that is nested inside the current filter group (instead of at the same level as the current group). Nested filter groups enable you to create more complex filters. In the screenshot above, for example, the nested group based on source city matches on any of its conditions while the overall group matches on all conditions. This enables the query to look at all traffic from Russia except traffic from either Moscow or St. Petersburg.

  Note: Not shown in all locations (see Filters Dialog Locations).

Ad Hoc Filter Controls

Each ad hoc filter in a filter group defines a condition and includes the following controls:

• Dimension selector: Opens a dialog (see Dimension Selector Dialog) enabling you to choose the dimensions (see Dimensions Reference) on which to filter.

• Direction button: Appearing just to the right of any directional dimension, this button toggles the perspective of the dimension between source and destination.

• Operator: The operator to apply in the filter. Options, which vary depending on whether the dimension takes numeric or alphanumeric values, may include:

  • Equals, does not equal

  • Greater than, less than

  • Contains, does not contain (case insensitive)

  • Matches regex/does not match regex

  • Equals the value of, does not equal the value of (applies only to certain dimensions, see Source/Destination Comparisons).

• Value: The value to match.

  Note: Leave the value undefined to include or exclude all records for which no value has been assigned to the filter dimension.

• Remove (X): Removes the filter from the group.

Source/Destination Comparisons

The following dimensions have the “equals the value of” and “does not equal the value of” operators available for comparing source and destination traffic:

Tip: These two operators can be useful for investigating:

• Traffic across various public cloud regions and availability zones in GCP, AWS, and Azure.

• Inter-site traffic based on source or destination IP addresses as defined in the Site attributes.

Dimension Selector Dialog

The dimension selector dialog allows you to choose a dimension on which to filter, and includes the following elements:

• Filter field: Filters the available dimensions to show only those whose name contains the entered text.

• Dimension lists: Lists of the available dimensions in each category, which are organized as described in Dimension Selection Groups.

Saved Filter Controls

Saved filters in filter groups have the following controls:

• Expand/Collapse (triangle icon): Shows or hides a saved filter detail, which is a read-only list of the filter groups and individual filters that make up the saved filter.

• Name: The name assigned to the filter when it was saved or edited.

• Description: The description text entered when the filter was saved or edited.

• Include/Exclude Results: A drop-down selector that determines whether results that match the saved filter are included or excluded from the results of the queries in which the filter is applied.

• Customize: Converts the saved filter into an ad hoc filter so that its filter groups and individual filters can be modified using the controls described in Ad Hoc Filter Controls.

• Filter details: A list of the individual filters (conditions) in the saved filter, as well as their associated logic for inclusion (include/exclude) and matching (any/all).

Save Filter Dialog

A collection of filter groups can be saved for later reuse in the Filtering Options dialog via the Add Saved Filter button in the Filter Groups Controls or the Group-level Controls. The saved filter will be available to all other users in the organization and will be labeled as a company filter (see Company Saved Filters) in the Saved Filters List (Settings » Saved Filters).

To save a filter, open the Save Filter dialog by clicking the Save Filters button in the Filter Groups Controls. The dialog has the following fields:

• Filter name (required): The unique, user-supplied name for the saved filter.

• Filter description: User-supplied text that will display when the cursor hovers over the filter in the Saved Filters selection box.

After entering the filter name and description, click the Add Filter button to save the filter.

Note: To see a list of existing company filters, go to Settings » Saved Filters and click Company in the Share Level selector (see Saved Filters Page UI).