Kentik generates two independent dataseries at ingest into the Kentik Data Engine (KDE), enabling efficient querying over extended periods without losing detail for shorter timespans.
About Dataseries Resolution
Kentik builds both the Full and Fast dataseries at data ingest, maintaining them as independent entities:
Full dataseries: Captures every flow record sent by a customer, adhering to the service agreement limits.
Fast dataseries: Contains a subset of flow records for quicker responses for queries over 24 hours. To optimize storage and speed, Kentik:
Groups Ports above 32767 (i.e., ephemeral ports) as port 65535.
Aggregates flows sharing the same 7-tuple.
Combines duplicate sequential flow records within minutes.
Downsamples data to 30 flows per second (fps) or 1800 aggregated flows per minute (fpm) per device.
Note: For different downsampling options, contact Customer Care.
The default dataseries for a query varies by timespan:
Full Dataseries: Used for timespans less than 24 hours.
Fast Dataseries: Used for timespans of 24 hours or more.
Note: The 24-hour criterion is based solely on the duration of the query's timespan, not how far back in time the query is looking (see Overriding the Default Dataseries).
Resolution Intervals
The dataseries resolution determines the interval (granularity) used for reporting packets and bytes:
Fast Dataseries: Query intervals "snap" to the nearest hour. For example, for a query from 1:05 PM on 5/12 to 10:31 PM on 5/15, the results will cover 1:00 PM on 5/12 to 11:00 PM on 5/15.
Full Dataseries: Query intervals vary depending on query width.
Overriding the Default Dataseries
You can manually override (see Query Resolution Selection) the default choice of dataseries in these cases :
Fast Dataseries: Manually select timespans as short as 3 hours for quicker responses.
Full Dataseries: Manually select timespans of up to 72 hours for detailed results.
Query Resolution Selection
The default dataseries selection may be overridden in both the portal and the API.
Portal Resolution Selection
In the Kentik portal, the dataseries selection is based on the timespan set in Data Explorer and Dashboards:
Dashboards:
Automatically selects Full for timespans less than 24 hours (see About Dataseries Resolution).
Selects Fast for timespans of 24 hours or more.
Data Explorer:
Three hours or less: Always uses Full.
More than three hours but less than 24 hours: Defaults to Full, can be switched to Fast.
24 to 72 hours: Defaults to Fast, can be switched to Full.
More than 72 hours: Always uses Fast dataseries.
API Resolution Selection
The Kentik API uses the same dataseries defaults as the portal, with an option to override using the i_fast_dataset query parameter:
Without
i_fast_dataset:Automatically selects Full for timespans less than 24 hours (see About Dataseries Resolution).
Selects Fast for timespans of 24 hours or more.
With
i_fast_dataset:false:Uses Full dataseries for timespans up to 72 hours.true:Uses Fast dataseries regardless of timespan.
Note: Avoid using the Fast dataseries for timespans under 3 hours and the Full dataseries for timespans over 72 hours.
© 2014-25 Kentik