Data Explorer improvements

Data Explorer Pivot to Dashboard

Every now and then, the simplest feature unveils a world of possibilities.  The new ability to “pivot” a row in the Data Explorer is a great example.

Clicking on the menu at the right of a row in the Data Explorer and selecting “Pivot” opens a (configurable) dashboard showing many different views of the chosen row of data based on different combinations of dimensions and metric.

This pivot feature allows rapid and comprehensive data exploration, reducing the need to manually construct a series of several ad-hoc views in the Data Explorer, for example when trying to identify “why this unexplained bump over this traffic graph occurred.”

For instance, if I am suspicious of traffic sourced in the Netherlands going to a specific IP address, here’s what I would do, taking advantage of the pivot feature:

Below, we see a dashboard that decomposes this NL → dest. IP traffic into multiple different dimensions, without making me go through the trouble of building a unique dashboard.

The pivot feature makes new paths of investigation practical that wouldn’t otherwise have been explored due to the time required to build such a dashboard, and the interruption building a dashboard causes to the investigation workflow.

The pivot feature is discussed in this Knowledge Base entry.

Data Explorer Side-bar Overhaul and Saved Views

As you’ve probably noticed, we revamped the UI of Data Explorer’s Query sidebar to further streamline its appearance.

At the same time, we’ve also added the ability to Create, Edit, and Save Views. Where you previously needed to rebuild your favorite queries in Data Explorer, you can now save them and go back to them to refine them or even share them.

The full documentation on Saved Views is available in our knowledge base under this article.

Saved Views come with an overhauled Data Explorer menu allowing quick access to them.

A new Saved Views Library section has been started, allowing users to share Saved Views within the same company, or even leverage Kentik’s library of pre-existing views.

This marks the initial steps towards a community driven initiative that will be started in the future for Kentik users to share their recipes on Dashboards, Views, Alerting policies.

Directly from the Data Explorer, look for the Save and **Load **controls at the top. With these, no more starting all over from scratch when improving on your (or your co-users’) existing visualizations. Conveniently load them and save them anytime.

Here’s a quick display of what the new Saved Views Library looks like:

Stay tuned and watch this community concept trickle down into further areas of the Kentik Detect Portal in the future.

Further IPv6 support in Data Explorer

Kentik has fully supported storage and querying of IPv6 for some time, and we are steadily adding support for IPv6 in any place where addresses or prefixes are used.

IPv6 Next-Hop flow dimension

Next-hop IP dimension in explorer and dashboards now supports IPv6 on top of the existing IPv4, as displayed in the Data Explorer Dimension selector below. Note that different CIDR thresholds can be set independently for IPv4 and IPv6.

IPv6 Source/Dest prefixes dimension

Metrics support for IPv6 added to explorer and dashboards: Unique src/dst prefix, Unique SRC/DST ASN, and Unique src/dst IP now support ipv6.

Alerting feature update

Alerting is now fully documented in our Knowledge Base; feel free to swing by and get a more detailed view of what it offers!

Additionally, Alerting now supports Route Prefix and Length (Prefix/LEN) both as a Dimension and in Filters.

API v5 updates

APIv5 documentation has been entirely updated, and is now available to our users at the following locations:

Additionally, an API functionality to return a URL to open an API call in browser (authenticated) has also been added.

Important note: The current plan is to shut down former API versions (namely v1 and v4) on May 5th.

Miscellaneous

ICMP code and type for v9/IPFIX is now supported. It is overloaded into the IP DST PORT values based on NetFlow v5 ICMP encoding.