Flow Widget

Edit online

The Flow widget can view, analyze, and interact with flow data such as NetFlow, sFlow, JFlow, IPFIX, and more. Perform the steps below to configure settings for the Flow widget.

Data

Edit online

The Data tab enables you to select the resources to graph.

Perform the following steps to set the widget settings for Data tab.

  1. For Datasource and Resource Type settings, please refer to section Select Widget Resources in section Create.
    Important:
    "Resource Type, Flow Source, allows you to search on flow version, name, and IP address. You must enter a string in double-quotes. Search can also be performed on a word. You may enter one or more strings/words in Resource Type > Flow Source.

    Example# 1
    If you enter "NBARDevice 1" dp-flow, these are 2 key terms to search on. All flow sources containing NBARDevice 1 and dp-flow will be available to choose from. NBARDevice 1 is in double-quotes as the search is on all words with space in between. A string can have one or more spaces in it.



    Example# 2
    If you enter NBARDevice 1 dp-flow, these are 3 key terms to search on. All flow sources containing NBARDevice, 1, and dp-flow will be available to choose from.

    Example# 3
    If you enter flow, all flow sources containing flow will be available to choose from. It can return flow sources such as dp-flow, flow2, etc.
  2. Click the Direction drop-down to select the flow direction (All Directions, Incoming, or Outgoing) to report on. Available only if Resource Type chosen is Flow Source.
  3. Enable Display Aggregated Views to show aggregated flow views.
  4. Enable Allow Flow View Selection to allow report consumers to temporarily change the flow view when viewing the report.
  5. Click the Flow view drop-down and select a Flow view.
    Note: If no flow view is selected, the mapped view or default cluster view will be used.
  6. Click the Sort Field drop-down to select the Flow data field to sort and visualize results on. If empty, the default field of the view is used.
  7. Click the Sort Order drop-down to sort the results in Ascending or Descending order.
  8. After selecting a flow view, Add button becomes available. Click Add to include the selected flow view into the report.
    Note:

    Execute this step only if you need to remove a resource query,

    Select one or more options from the Current resources list or you may select the select all check box to choose all the resources in the list. Click the Remove button to remove the current resources.

  9. In the Result limit field, enter the number of results to display.
    Important: Result limit greater than 200 can impact performance.
  10. By default, field Flow Chain Search Limit is enabled. When enabled, it allows you to enter the limit which determines how many flow interfaces are considered when chaining from Flow to Performance Metrics. The default value for the limit is 10 and the range is 1 - 9999. Limit set to greater than 10 can impact performance. Disabling Flow Chain Search Limit can help with the performance but you will not be able to chain from Flow to Performance Metrics.
    Important: Field Flow Chain Search Limit is only available when the following is true,
    • the datasource selected is greater than or equal to SevOne NMS 6.6.0
    • SPLIT > field Split results by: Interfaces under tab Analyze is not enabled
  11. Enable Graph Remaining Traffic to show remaining traffic not defined in the results limit on the graph.
  12. Click Run to generate a Flow report based on the configuration.
    Note: Run button is only available when one or more fields are changed in the Data tab.

    Example

    Flow Data
    Note: If Resource Type chosen is Flow Interface and Direction chosen is All Directions, then under Current resources, you will see ALL which indicates all directions. If direction chosen is Incoming, current resources will contain INCOMING for the interface and similarly, for Outgoing, current resources will contain OUTGOING.

    Flow Template Mappings

    Allows user to view flow template mappings when Flow Key Lookup Table is set in SevOne NMS.

    SevOne NMS - Example# 1

    NMS Flow Data Lookup Table

    SevOne Data Insight - Example# 1

    Data Insight Flow View Editor Lookup Table - 1

    SevOne Data Insight - Example# 2

    Data Insight Flow View Editor Lookup Table - 2

Analyze

Edit online

The Analyze tab enables you to define settings for the data you retrieve and to use data analysis features.

Data Insight Flow Analyze

Perform the following steps to set the widget settings for Analyze tab.

  1. UNITS
    1. Select the Display asrate check box to display the results as rate. Otherwise, it will display the results as total volume. The results can be displayed in Bits or Bytes.
  2. SPLIT
    1. Enable Split results by to separate flow data into individual Interfaces. Disable it to combine all results from the same direction across the same interface to allow for greater detail in the result set.
  3. AGGREGATION
    1. Click the Granularity drop-down and select the interval between data points in the results. The granularity is how to roll-up the data. Select Auto (default value) to use the highest applicable granularity for the best display and fastest load time based on the timespan selected. You may alter this setting based on your requirements. But, if the granularity becomes too small for the timespan set, it will be adjusted automatically.
    2. Click the Network Segment drop-down to group the results by network segment. This enables you to resolve the IP addresses into segments and to roll up the results from the same segment into a single result.
  4. RESOLUTION
    1. DNS
      • Display IP** - to display raw IP addresses.
      • Display DNS** - to display resolved domain names when possible.
      • Display both - to display both IP addresses and resolved domain names.
    2. Protocols
      • Display number - to display raw protocol numbers.
      • Display name - to display resolved protocol names.
      • Display both - to display both numbers and resolved protocol names.
    3. Ports
      • Display number - to display raw port numbers.
      • Display name - to display resolved port names.
      • Display both - to display both numbers and resolved port names.
    4. DSCP
      • Display number - to display DSCP port numbers.
      • Display name - to display resolved DSCP port names.
      • Display both - to display both numbers and resolved DSCP port names.
    5. Country
      Important: Options under Country are only available if Flow view field under Data tab is set to either Top Conversations Country or Top Conversations AS and Country. And, SevOne NMS 6.4 or above is required to use this feature.
      If the country cannot be determined from the flow, the report will return ?? in the appropriate country columns.
      • Display flag - to display the country flag.
      • Display name - to display the country name.
      • Display both - to display both flag and country name.
    6. AS
      • Display flag - to display AS port numbers.
      • Display name - to display resolved AS port names.
      • Display both - to display both numbers and resolved AS port names.
  5. TIME
    By default, timespan / time zone selected is Past 2 hours New_York. Click the button to change the timespan / timezone. Select one of the following options:
    • Past <n>hours, days, weeks, months, quarter, year - to display data from hours, days, weeks, months, quarter, or year ago until now.
    • Today - to display data from 12:00am today until now.
    • Yesterday - to display data from 12:00am yesterday until 12:00am today.
    • Last week, month, quarter, year - to display data from 12:00am on the first day of the last completed week, month, quarter, or year to 11:59pm on the last day of the last completed week, month, quarter, or year.
    • This week, month, quarter, year - to display data from 12:00am on the first day of the week, month, quarter, or year until now.
    • Customize the time span with From and To date / time.
    • Click Select button to choose the modified timespan / time zone.

Filters

Edit online

The Filters tab enables you to apply filters to display results.

Important: The selected NMS datasource must be SevOne NMS 5.7.2.27 or higher. Otherwise, some functionality may be missing.
Flow Filters

Perform the following steps to set the widget settings for Filters tab.

  1. In the Filter Name field, enter the filter name.
  2. Select Combination. Choose from Or or And.
  3. For Attribute 1, click the drop-down to select an attribute. For example, Application IP. The available attributes are based on the Flow view selected in the Data tab.
  4. Click the identity operator drop-down and choose from options Is or Is Not.
  5. Click the relational operator drop-down to select an operator. For example, Equal To, Less Than, Greater Than, Between, Mask, Subnet.
    Important: Unmapped traps / flow alerts are not viewable. You must have the traps / flow alerts mapped to resource(s) i.e., SevOne device(s) / object(s) to be able to view them.
  6. In the Value... field, enter a value for the attribute you have selected. Click Plus icon to add more values. To delete a value, click Delete.
  7. Click Add Attribute to add another attribute. Click Delete to delete an attribute. Attributes are used to add additional filter criteria and are combined based on Or or And chosen in the Combination field.
  8. Click Create to save the new filter.
  9. Click the name of an existing filter, make changes, and click Update to modify an existing filter or click Create to make a new copy of the filter with your changes.
  10. The filter added will appear in the bottom panel under Current filters.
  11. To remove any filter(s) from the Current filters list, select the filter to delete and click Remove. To delete all filters, click Select all and then, click Remove.

Linking

Edit online

The Linking tab enables you to select a data element and link it to a related report or report template. Perform the following steps to add, delete, and edit links.

Flow Report Linking

for Flow > Performance Metrics Report Linking,


  • For SevOne NMS <= 6.5.x, you will need to enable Analyze > SPLIT > Split results by > Interfaces in order to get indicator variable passed to the report that you are linking to.
  • For SevOne NMS >= 6.6.x, you will automatically get the results when you link from all visualizations except the Table visualization when linking on Value. For Table visualization, you must enable Analyze > SPLIT > Split results by > Interfaces to get the NetFlow Information column that you can link from.
    Important: The device / object / indicators displayed in the chained Performance Metrics widget are limited to 10 unique flow devices / interfaces / directions associated with each row in the flow widget. The top 10 interfaces are sorted by the bandwidth metric and they must also be managed via SNMP (i.e., they should be mapped). This limit ensures report performance of the chaining workflow in large deployments.
  • Flow devices and interfaces must be mapped to the metric device and objects.
  • Works based on indicator variable. The Performance Metrics report must have an indicator variable with multiple select enabled (when Analyze > SPLIT > Split results by > Interfaces is not enabled).
  • Works based on indicator variable. The Performance Metrics report must have an indicator variable with multiple selection enabled (when Analyze > SPLIT > Split results by > Interfaces is not enabled).

Perform the following steps to set the widget settings for Linking tab.

  1. Include report links when enabled, allows you to include the report link that you configure. If you want to prevent the report link from being included, disable it. Continue with the steps below to configure report link(s).
  2. Click Add report link button to add a report link.
  3. By default, Report Link 1 is enabled.
    Note: If you wish to exclude the report link, disable Report Link 1.
  4. The Clicking on drop-down has only one possible data item - Value. When report linking is enabled, clicking on this data item will link to the report or report template that you specify below.
  5. Click the Links to report drop-down and select one or more reports or report templates to display when you click on the data item that you specified in the previous step.
  6. To remove the report link, click Trash can icon.
  7. To create additional report link(s), click Add report link button .

Charts

Edit online

The Charts tab enables you to define how you want to display the report data.

Visualizations

Edit online

The charts provide 5 visualizations.

Flow Visualization Charts

Table

Edit online

The Table visualization displays the data as a table. Perform the following steps to set the widget settings for the Table visualization.

  1. Select the Table visualization by clicking Table visualization .
  2. TABLE CHART TITLE
    1. Enable Show title to enter the title name in the text field provided and display it in report. Else, disable it.
    2. Enable Show subtitle to enter the sub-title name in the text field provided and display it in the report. Else, disable it.

  3. TABLE

    1. Select Allow column reordering check box to allow the columns that display in the report to be reordered.
    2. Select Allow showing/hiding columns check box to allow columns in the report to be hidden and unhidden.

    3. Enable Auto abbreviate numbers to abbreviate large numbers. Examples of large integer abbreviation are:

      • 5000 becomes 5K

      • 5000000 becomes 5M

      To abbreviate large decimal numbers, you must enter the data precision in the Custom precision field. To do this, follow the steps below:

      1. Disable Auto abbreviate numbers field.
      2. Custom precision field is now available.
      3. Enter the data precision in the Custom precision field. For example, enter 4.
      4. The values displayed in report will now display data with the data precision entered. Examples of large decimal number abbreviation are:
        • 20.12345 will display as 20.1234 when Custom precision = 4
        • 20.12345 will display as 20.12 when Custom precision = 2
        • 20.14912 will display as 20.15 when Custom precision = 2 NOTE: Number is rounded.
    4. Select Wrap cell content check box to wrap long text in a data row so that all text displays. Disable it to display as much text as fits into the cell with ellipses to indicate there is more text.
    5. By enabling Show search bar, the search capability is available to perform a search in the table. Disable it if you do not want the search capability. If Show search bar is enabled, you may click Funnel icon to allow Search by column.
  4. COLUMN SELECTION
    1. Select the check boxes to display the selected fields as data columns in the table. The names in the second column are the names for the columns that appear in the report. You may modify the names in the second column to your choice.

  5. COLOR RANGES

    Note: The color ranges must be from the least to the greatest values.
    1. Enable Use custom color ranges to customize the colors for the cells or rows. Else, disable it.
    2. If Use custom color ranges field is enabled, select one of the following options:
      • Color cell only - to apply the color to a cell only.
      • Color entire row - to apply the color to the entire row.
    3. Click the Color column drop-down and select the column to apply the color to. This list contains the columns selected in COLUMN SELECTION above.
    4. In the From field, enter the starting point for the range that applies to the column you selected in the previous step. This is the starting point for the color range.
    5. In the To field, enter the end point for the color range.
    6. Click White color to display the color palette. Select a color to apply to the specified range.
    7. Click the drop-down to choose an icon to add to the color range. Select one of the following icons:
      • None - indicates no icon is chosen. Or, leave as blank if you do not want to specify an icon.
      • Checkmark indicator - indicates that everything is okay.
      • Error indicator - indicates that something is wrong.
      • Warning indicator - indicates a warning.
    8. Click Add Color to add additional end points to the specified range. Then specify a color and add an Icon to display if needed.
    9. Click Reverse Colors to reverse the order of the colors (from top to bottom or vice versa) in the To fields.
    10. To delete the color range, click Trash can icon.

    Example: Analyze tab > UNITS = Bits Flow Visualization Table Bits - 1 Flow Visualization Table Bits - 2

    Example: Analyze tab > UNITS = Bytes Flow Visualization Table Bytes - 1 Flow Visualization Table Bytes - 2

Pie

Edit online

The Pie visualization displays the data as a pie graph. This visualization is useful for percent reports such as when you need to graph the available hard drive space on a device. Perform the following steps to set the widget settings for the Pie visualization.

  1. Select the Pie visualization by clicking Pie visualization .
  2. PIE CHART TITLE
    1. Enable Show title to enter the title name in the text field provided and display it in report. Else, disable it.
    2. Enable Show subtitle to enter the sub-title name in the text field provided and display it in the report. Else, disable it.
  3. PIE
    1. Enable Show tooltip to display tooltips when you hover over sections of the pie graph or over labels (if labels are used). Select the check box for each of the following options that you would like to apply to the tooltips:
      • Name - to display the device name.
      • Bandwidth - to display the amount of bandwidth used.
      • Packets - to display the amount of packets.
      • Flows - to display the amount of flow traffic.
      • Percent - to display the percentage of the pie graph for the section.

        If you do not want to display the tooltips, disable Show tooltip.

    2. Enable Enable "Others" to add a slice called Others that rolls up values below the percentage value entered in field Percentage.
    3. Style of pie chart
      • It provides 3 different visualizations.
        • Donut Flow Visualization Pie Donut
        • Pie Flow Visualization Pie Pie
        • Nightingale Flow Visualization Pie Nightingale
    4. Under Radius, extend the bar to the right to increase the radius or shorten the bar to decrease the radius.
    5. Select Show labels to display labels for the device name, object name, indicator name, and percentage of the pie graph. Else, disable it.
  4. LEGEND
    1. Enable Enable legend to display a legend for the graph. Else, disable it.
    2. Select one of the following options:
      • Standard - to display legend in the standard format.
        • Click the Position drop-down to specify where you would like the legend to appear in relation to the graph. The position is set to Bottom by default. Other options include Top, Left, and Right. Flow Visualization Pie Standard
      • Table - to display the legend in table format. Flow Visualization Pie Standard

Bar

Edit online

The Bar Chart visualization displays a graph of qualitative independent variables. Perform the following steps to set the widget settings for the Bar visualization.

  1. Select the Bar Chart visualization by clicking Flow Bar Chart Visualization Icon.
  2. BAR CHART TITLE
    1. Enable Show title to enter the title name in the text field provided and display it in report. Else, disable it.
    2. Enable Show subtitle to enter the sub-title name in the text field provided and display it in the report. Else, disable it.
  3. BAR
    1. Enable Show tooltip to display tooltips when you hover over sections of the bar graph or over labels (if labels are used). Select the check box for each of the following options that you would like to apply to the tooltips:
      • Name - to display the device name.
      • Bandwidth - to display the amount of bandwidth used.
      • Packets - to display the amount of packets.
      • Flows - to display the amount of flow traffic.

        If you do not want to display the tooltips, disable Show tooltip.

    2. Style of bar chart provides 2 different visualizations.
      • Horizontal - to display horizontal bars. Flow Visualization Bar Horizontal
      • Vertical - to display vertical bars. Flow Visualization Bar Vertical
  4. LEGEND
    1. Enable Enable legend to display a legend for the graph. Else, disable it.
    2. Select one of the following options:
      • Standard - to display legend in the standard format.
        • Click the Position drop-down to specify where you would like the legend to appear in relation to the graph. The position is set to Bottom by default. Other options include Top, Left, and Right.
      • Table - to display the legend in table format. Flow Visualization Bar Table
  5. GOAL LINES
    1. Enable Show Goal Lines check box to add one or more goal lines to the graph. Then perform the following actions:
      • In the Name field, enter a name for the goal line.
      • In the Value field, enter a target value for the goal line.
      • Click Yellow color to display the color palette. Select a color to apply.
      • To add another goal line, click Plus Icon and repeat the actions above.
      • To remove a goal line, click Trash can icon next to that goal line.

Line

Edit online

The Line Chart visualization overlays all indicators and displays each indicator with its own line. You can define line graphs to display trends and past data as an additional line on the graph. Perform the following steps to set the widget settings for the Line visualization.

  1. Select the Line Chart visualization by clicking Plus icon .
  2. LINE CHART TITLE
    1. Enable Show title to enter the title name in the text field provided and display it in report. Else, disable it.
    2. Enable Show subtitle to enter the sub-title name in the text field provided and display it in the report. Else, disable it.
  3. LINE VISUALIZATIONS
    1. Select the Area check box to fill the background of the graph with color.
      • The Stack check box is enabled when you select the Area check box. Select it to display each graph line stacked above the prior graph line to better visualize how values compare as a whole. A stacked line graph extracts the poll points that occur at different times and calculates the averages to plot the data points on the graph as though they occur at the same time.
    2. Select the Smooth line check box to visually smooth the angles of the line.
    3. Select the Show zooming bar check box to display the following control on the graph:
      • Restore icon - to restore default settings.
    4. Select the Show panning bar check box to display a panning bar beneath the graph. Use the panning bar to change the portion of the time frame to represent on the graph.
    5. Unselect Enable live zooming check box to display the following controls on the graph:
      • Zoom-In icon - to zoom in on the graph.
        Note: To zoom in, click this icon. Select the area on the line graph you want to zoom in on. The panning bar at the bottom of the line graph is independent of this.
      • Zoom-Out icon - to zoom out.
    6. Enable Show tooltip to display tooltips when you hover over sections of the line graph or over labels (if labels are used). Select the check box for each of the following options that you would like to apply to the tooltips. For example, Timestamp, Name, Value, Show Cross, etc.
  4. CHART AXIS
    1. For Y Axis Max, enter a maximum value for the y-axis.
    2. For Y Axis Min, enter a minimum value for the y-axis.
  5. LEGEND
    1. Enable Enable legend to display a legend for the graph. Else, disable it.
    2. Select one of the following options:
      • Standard - to display legend in the standard format.
        • Click the Position drop-down to specify where you would like the legend to appear in relation to the graph. The position is set to Bottom by default. Other options include Top, Left, and Right.
      • Table - to display the legend in table format. Also, it allows you to select the columns to include in the table. For example, Total, Field, Minimum, Maximum, Average, etc. Flow Visualization Line Table

  6. Goal Lines

    1. Enable Show Goal Lines check box to add one or more goal lines to the graph. Then perform the following actions:
      • In the Name field, enter a name for the goal line.
      • In the Value field, enter a target value for the goal line.
      • Click Yellow color to display the color palette. Select a color to apply.
      • To add another goal line, click Plus icon and repeat the actions above.
      • To remove a goal line, click Trash can icon next to that goal line.
    Flow Visualization Line

Sankey

Edit online

The Sankey visualization displays data as a Sankey diagram which allows you to visualize multiple DIMENSIONS based on the flow view selected under Flow Views. Each dimension column represents a flow field in the view where the data is represented by nodes. The connections between the nodes represents the amount of traffic.

Example: Flow Views - Top Conversations and Direction selected,

For flow view Top Conversations and Direction, DIMENSIONS available in data bar are:

  • Client IP
  • Application Direction
  • Application IP

Select one or more check boxes under DIMENSIONS for it to appear in the Sankey diagram. In the screenshot below, all 3 check boxes are selected. Based on this, the selected dimensions appear in the Sankey diagram in the order they appear under DIMENSIONS. In the Sankey diagram,

  • Column 1 - for Client IP (i.e., client IP address / client hostname)
  • Column 2 - for Application Direction
  • Column 3 - for Application IP
Flow Visualization Sankey

Click 6dots to drag-n-drop the check boxes under DIMENSIONS to reorder them. In the screenshot below, you will see that the check boxes under DIMENSIONS are now in the following order.

  • Application Direction
  • Application IP
  • Client IP

Select one or more check boxes under DIMENSIONS for it to appear in the Sankey diagram. In the screenshot below, all 3 check boxes are selected. Based on this, the selected dimensions appear in the Sankey diagram in the order they appear under DIMENSIONS. In the Sankey diagram,

  • Column 1 - for Application Direction
  • Column 2 - for Application IP
  • Column 3 - for Client IP (i.e., client IP address / client hostname)
Flow Visualization Sankey

Based on the flow view selected, each key field is included in the Sankey diagram with linkages / connections between the dimensions selected. It represents the amount of traffic in terms of the metric chosen under MEASURE. For example, metric can be Bandwidth or Packets or Flows or Multicast Packets or Multicast Bandwidth. In the example above, MEASURE selected is Bandwidth.

Under AGGREGATION, you may choose from options Sum, Min, or Max to display the aggregate value(s) based on the option chosen.

Flow fields in the Flow Views are configured on SevOne NMS. For details, please refer to SevOne NMS Administration Guide > section FlowFalcon View Editor.

If you want the Sankey diagram to only show linkages / connections between dimensions Client IP and Application IP, uncheck check box for dimension Application Direction.

Important: If all dimensions except 2 are unchecked, then it will gray out those 2 dimensions and not allow you to uncheck them. You must have at least 2 dimensions selected.

In the screenshot below, 2 out of 3 check boxes are selected. Based on this, the selected dimensions appear in the Sankey diagram in the order they appear under DIMENSIONS. In the Sankey diagram,

  • Column 1 - for Client IP (i.e., client IP address / client hostname)
  • Column 2 - for Application IP Flow Visualization Sankey
Important: The details described in the example, Flow View - Top Conversations and Direction above, apply to the following examples below as well.
  • Flow Views - Top Conversations with Application and ToS and Direction
  • Flow Views - Top Flows with Next Hop and ToS and Direction

Example: Flow Views - Top Conversations with Application and ToS and Direction selected,

For flow view Top Conversations with Application and ToS and Direction, DIMENSIONS available in data bar are:

  • Client IP
  • ToS
  • Application Direction
  • Application Port
  • Application IP Flow Visualization Sankey

Example: Flow Views - Top Flows with Next Hop and ToS and Direction selected,

For flow view Top Flows with Next Hop and ToS and Direction, DIMENSIONS available in data bar are:

  • Client IP
  • Client Port
  • Next Hop IP-1
  • ToS
  • Application Direction
  • Protocol
  • Application Port
  • Application IP
Flow Visualization Sankey

Perform the following steps to set the widget settings for the Sankey visualization.

  1. Select the Sankey visualization by clicking Sankey visualization. Flow Visualization Sankey
  2. SANKEY CHART TITLE
    1. Enable Show title to enter the title name in the text field provided and display it in report. Else, disable it.
    2. Enable Show subtitle to enter the sub-title name in the text field provided and display it in the report. Else, disable it.
  3. SANKEY
    1. To configure the width of the nodes, under Node Width, extend the bar to the right to increase the width or shorten the bar to decrease the width.
    2. To configure the size of the gap between nodes, under Node Gap, extend the bar to the right to increase the gap size or shorten the bar to decrease the gap size.
    Flow Visualization Sankey