- Getting started
- Architecture
- Administration
- User interface
-
System configuration
- Installation of software packages
-
Relays
- The In-house Relay
- In-house Relay rules
- In-house Relay configuration
- In-house Relay installation using a virtual machine
- In-house Relay installation using the software package
- Installing the USA relay on an Ubuntu 16 VM server
- CentOS relay installation
- Relay installation in any Linux distribution
- High-availability relay
- In-house Relay troubleshooting
- Sending the data
- Supported technologies
-
Data Search
- Running a search
- LINQ
- Viewing the data tables
- Viewing column info
- Running queries (tutorials)
- Last queries
- Query management
- Lookup management
- Favorite queries
- Sharing queries
- Table toolbar features
-
Additional tools
- Dashboard data source
-
Charts
- Affinity chord diagram
- Availability timeline
- Bipartite chord diagram
- Bubble chart
- Chart aggregation
- Custom date chart aggregation
- Flame graph
- Flat world map by coordinates
- Flat world map by country
- Google animated heat map
- Google area map
- Google heat map
- Graph diagram
- Histogram
- Pie chart
- Pie layered chart
- Punch card
- Sankey diagram
- Scatter plot
- Time heatmap
- Voronoi treemap
- Graphical correlation
- Query Info
- Custom tables
- Aliased finder
- Custom finder
- Data reinjection
- Available operations
- Best practices for data search
- Alerts management
-
Dashboards
- Setup a data source
- Create a new dashboard
-
Working with dashboard widgets
- Availability timeline widget
- Chord diagram widget
- Circle world map widget
- Color key value widget
- Color world map widget
- Column chart widget
- Comparative chart widget
- Funnel widget
- Gauge meter widget
- Google heatmap widget
- Heat calendar widget
- Line chart widget
- Monitoring widget
- Pie chart widget
- Punch card widget
- Sectored pie chart widget
- Table widget
- Time heatmap widget
- Tree diagram widget
- Voronoi tree widget
- Configuring and sharing dashboards
- API
- Use cases
Filters
Apply filters to table data to isolate or exclude specified field values. The results are returned immediately and displayed in chronological order and at the same time, the timeline is updated to match the query. Select Filter from the query toolbar. The Operations Over Columns window appears with the Filter data option selected.
- Select the Operation type. Choose normal to include the filtered events, or select negated to exclude the filtered events.
- Click New Argument to add the argument (or arguments) you will use for the filter. You can also enter free text as a filter argument as is sometimes required for an operation. For example, you might filter for URLs that contain the string, bing.
If you select a cell from the data table and press ENTER, the Operations over columns window will be open. The cell selected and the column it belongs to will be automatically added as arguments.
Example: Filtering to remove null value events
A common use case for filtering is to remove events with null or 0 values. Here's an example:
- Go to Data search and run the following search: web.apache.acces-lt.
- Click to highlight the Coordinates column, then select Filter from the toolbar.
- Select is not null as the operation.
- Select Filter Data. The result contains all events where the coordinates field in not null.
Example: Filtering by IP type
Another use case is to identify the private or public IP sources. Here's an example:
- Go to Data search and run the following search: firewall.all.traffic.
- Click to highlight the SrcIp column, then select Filter from the table toolbar.
- Select Is Private IPv4 as the operation.
- Select Filter Data. The result contains all the private IP sources.
See Filtering operations for more information on the operations you can use when filtering the data.