Search and Filters

Search syntax

Spider uses the Lucene query syntax to search across all the communication data captured.

You may use the free search input to search and filter on nearly any field of the data.
But instead of writing a complex query, you may use Spider filters helpers to build the search query for you.

Free search

You may in your search directly in the search input.

• In the free search section of the extended menu
• In the search input when the menu is folded

It supports the complete Lucene syntax, and offers color syntaxing and field autocompletion to help.
You may enter new lines with Shift + Enter

Lucenes syntax is very powerful, allowing you to build complex queries:

• Field value filtering: field:value
• Boolean operators: AND, OR, NOT - req.method:GET AND NOT res.status:200
• Wildcards: * (any number of characters), ? (one character) - stats.src.identification:routingDevice-*
• Range queries: [a TO z] inclusive, {a TO z} exclusive
• Date ranges: [2022-01-01 TO 2022-12-31]
• Numeric ranges: [10 TO 20], {10 TO 20}, res.duration:>10, res.duration:<=10
• Grouping: req.method:(GET OR POST)
• Regular expressions: stats.src.identification:/routingDevice-[0-9]+-2026/

If you need to use a special character, escape it with backslash \.

Unsupported regular expression operators

Lucene’s regular expression engine does not support anchor operators, such as ^ (beginning of line) or $ (end of line).
To match a term, the regular expression must match the entire string.

See: Regular expression Syntax

tip

It is often easier to:

1. Select a filter using the helpers
2. Edit it in the free search afterward to customise it freely

Understanding filters

Filters are search criteria restricting the data working set.
Filters may be strict values, inequality, ranges or even regular expressions.

They are keys to Spider strength, to target the needle inside the haystack

Where are filters?

Filters may be set from many parts of the UI, with a lot of helpers

• From the menu
• From grid columns headers
• From the map
• From the dashboard
• From details panel
• From many tooltips
• From the stats graphics
• ...

Types of Filters

Spider includes a lot of helpers to help you build filters quickly, without minding on the search syntax.

Filters may be of different types:

• Value filters
• Range filters
• Text filters
• Prebuilt filters

Value filters

Value filters have a discrete set of possible values on which to filter.

• You may select one or several values
• You may filter the proposed values by typing

The set of values are retrieved dynamically from the working set when you open the filter drop down.
The set of values is restricted to the current visible timeline, not to the selection.

note

As the value are for the whole timeline, the dropdown may show you values that are not visible in the grid, dashboard or map.
Indeed the latter are only showing current time selection.

Range filters

Range filters are filtering a continuous value between two inclusive thresholds.

Selection is made from a small histogram similar to the timeline

The histogram is retrieved dynamically from the working set when you open the filter drop down.
As for the value filters, the histogram is restricted to the current visible timespan of the timeline, not to the selected time.

Text filters

Text filters are free filters you may input by typing in.

You may also type in a regular expression when checking the appropriate checkbox.

Prebuilt filters

Prebuilt filters are filters prebuilt by Spider to help you get faster to your goal.

• On the dashboard, you may drill down any visible value.
• On the map, you may filter (in/out) a server/service, or a link between two nodes. You may also drill down from the tooltips.
• On stats, you may filter straight to outliers
• On grid/details, you may filter for communications with correlation id
• With plugins, you may even filter on a tag by its business translated value!!
• ...

You wouldn't be able to build this one manually, right? 😁

Prebuilt filters are everywhere in Spider. Try them!

Filters modifiers

When activating a filter on dashboard, map, details or tooltip, you may modify the action with the keyboard:

• Click: add new one to existing filters
• Shift + click: replace existing filters by this new one
• Ctrl + click: add to existing filters, but avoid this filter
• Ctrl + Shift + click: replace and avoid

Selected filters

Selected filters are displayed on the top of the UI

A loaded query is displayed with a light background.

Unitary filters are shown with:

• The field being filtered
• The filter value

A filter may be negated, with a NOT in front.

Each filter includes a small menu where it may be:

• Removed
• Inverted (NOT)
• Disabled
  • The filter is still visble, but greyed out as inactive
• Edited in the query
  • The filter is added in the free search input

Save & reload filters

Save query

A set of selected filters builds up a query.
This query may be saved for later reuse.

1. Click on Save button
   • Either in the search icon bar in the menu
   • Or right to the free search input at the top of screen
2. Specify a name
3. If the name already exists, you cannot replace it
   • You may however delete the previous saved one first

info

Saving queries is a very important feature to know to save time reusing previous queries.

Load a query

To reload a saved query:

1. Click on the Load saved query button.
2. Select the query to load by clicking on it
3. It will be loaded as a filter by itself

Other filters may be selected aside it.

Breakdown a query

You may break down a selected query in its filter menu.

It will decompose the query in its sub filters.

note

To save a query embedding another query, you need to break it down first.

Delete a saved query

You may delete any personal saved query by clicking on the delete button next to them in the Load query drop down.

Removing filters

You may remove filters one by one:

• Directly from the selected filters list
• From the select drop-down for the values filters.

Filters may also be removed all at once using icon.

Filters history

When adding / modifying filters with free query, Spider keeps an history of the filters you validated.

To access this history:

• Focus on the one-liner search input when it is empty (when menu is folded)

• Or click on the history icon in the free search section of the extended menu.

History items may be removed at your convenience, and are limited in number.