Intelligence Filtering

You can filter the information shown in the Intelligence graph and table views of log data, to refine the query and remove clutter from the view. This helps you identify and concentrate on events of interest in the log data.

You can apply filters in different places in these views.

Quick filters on graph data

When you have selected or created a query in Intelligence (for any view), then you can filter the displayed graph view. These quick filters remove events from the displayed graph.

The quick filter box is below the query box.

The filter options change based on the specific graph (Traffic or Event activity).

You can select more than one filter option. In addition, you can clear filters that have been selected. The selected filters are applied (with a logical AND) to the underlying query data shown in the graph. The initial query statement is unchanged.

Click Start to re-run the query with the filter selection.

Filters on specific entities

You can filter graphs or log table views for specific entities, based on the type and value (for example, an instance with a specific name, or a specific IP address). These filters add phrases to the initial query statement.

In Graph views

In the Traffic or Event Activity graph views, you can select entities from the detail pane (on the right) and add them to the query statement.

  1. Click on an entity in a graph (for Traffic or Event activities), to show detail for it (in the detail pane, on the right).

  2. Click on an entity in the detail or Statistics pane.

  3. Select the logic to connect it to the query (AND, OR, NOT). The phrase is added to the query statement.

In Table views

In table views of log data (opened by clicking OPEN LOGS from the graph views), you can add query phrases for specific entities to the query statement.

  1. Click on a record in a table (for either Traffic or Event activities) to see its details.

  2. Click on an entity in the detail pane.

  3. Select the logic to connect it to the query (AND, OR, NOT). The phrase is added to the query statement.