Browse telemetry
Browse shows the raw events your log shippers send to Huntbase, and you filter them by clicking. Click a value in a field list, an event or a table cell and it becomes a filter. Huntbase writes those filters as a query, so you can open the exact query behind what you see, run it, save it or schedule it.
Browse is the second mode of a query tab. A Browse / Query toggle at the left of the bar switches between them. Browse reads the telemetry that arrives through telemetry ingest keys. That covers the Huntbase data lake and any lake of your own that a key writes to.
This feature is currently rolling out and may not be enabled for your organization.
Open Browse
| From | How |
|---|---|
| Explorer | Open the + menu in the tab bar and choose Browse telemetry. It opens on every source for the last hour. |
| A query tab | Click Browse in the mode toggle at the left of the bar. |
| Connections › Telemetry | Click View events on a source, or on one of the issues above the table. See Connections. |
| A Scout chat | Click Open in Browse on a telemetry result, or Apply filters on a view Scout suggests. See Scout and your telemetry. |
| A hunt | Click Open in Browse on a telemetry view cell. See Telemetry view cells. |
| A saved view | Open a query saved with Save view. It opens in Browse, not Query mode. |
Each of these opens a new tab named Browse telemetry. The view is carried in the link, so the tab opens with the same sources, time range and filters.
The bar
The bar has the same layout as in Query mode. The language and connection pills are replaced with a source picker, and the editor with a search box.
| Control | What it does |
|---|---|
| Scope | The same scope pill as Query mode. Browse shows sources from the organizations in your scope. |
| Sources | All sources · N by default. Open it to pick one or more sources, or Every source. Each source has a status dot and shows where it writes (Huntbase lake, or your lake store's name). |
| Time range | Last 15 minutes, Last 1 hour (the default), Last 4 hours, Last 24 hours, Last 7 days, Last 30 days, or Custom range…. |
| Search | Type any value and press Enter to keep only the events that contain it anywhere. When you type a question instead, an Ask Scout button appears. It sends the question to Scout along with the view. |
| Live tail | Streams new events into the view as they arrive. See Live tail. |
Under the bar is a line that says how many sources the view covers, their current rate (~N events/min) and where they write (Huntbase data lake, Your lake, or both). The Save view, Show as query and Ask Scout buttons are at the right of that line.
Filter by clicking
A filter is created every time you click a value:
- Fields tab: the + and − next to a top value include or exclude it. Clicking the value itself includes it.
- An expanded event: the + (Include) and − (Exclude) next to each field.
- Table view: click a cell to keep only events with that value.
Each filter appears as a token under the bar. Include is shown as field = value and exclude as field ≠ value. Has field and Missing filters read field exists and field missing. When you include a second value for the same field, it's added to the existing token (host = web-01, web-02), so the token matches either value. Including a value that you'd excluded moves it rather than contradicting the exclusion.
On each token:
- ⇄ (Switch include / exclude) flips the filter between include and exclude.
- × removes the filter.
Clear all removes every filter, the search and any zoom. It keeps your sources and time range. When there are no filters, the row reads No filters. Click a value in Fields or in an event to add one.
The Fields tab
The Fields tab in the side panel lists every field in the current view. Each field shows its coverage, which is the share of events in the view that have it. Fields are ordered by coverage. Use Find a field… to narrow the list.
Click a field to see its top values with their counts and an estimate of how many distinct values it has (~N distinct). host and event_type are open by default. A field that not every event has also offers Has field, and every open field offers Missing.
The counts cover the whole view, not just the events on screen. For a large view, the field list and coverage are worked out from a sample of the most recent events. The note at the bottom of the tab then says sampled and gives the sample size, and so does each open field until its exact counts load. Opening a field always counts its top values over the whole view.
The volume strip
Above the events, Volume charts the view over its time range, stacked by source. Beyond the top few, the remaining sources are grouped under Other sources.
Click a bar to zoom the view to that slice of time. A time token appears with the filters, and Back appears on the strip. Either one returns you to the range you had before. Picking a new range in the bar also clears the zoom.
Events and table
The results header shows the number of events that match the whole view. A number that starts with ~ is an estimate. More events load as you scroll.
| View | Shows |
|---|---|
| Events | One line per event, newest first. Click a line to expand it. |
| Table | One column per field. Click a cell to filter to that value. |
Map and Graph aren't available in Browse. Telemetry events don't carry coordinates, and Browse shows raw events rather than entities. To see entities in a graph, use Show as query or start a hunt.
Act on one event
An expanded event lists every field with Include and Exclude, followed by these actions:
| Action | What it does |
|---|---|
| Show surrounding events | Changes the time range to 5 minutes either side of the event and keeps your filters. Remove the time token to go back. |
| Start a hunt | Creates a hunt named after the event and pins the 5 minutes either side of it, with your current filters, as a telemetry view cell titled Events around the starting event. |
| Ask Scout about this event | Opens Scout with the event and the view attached, and asks what the event is, whether it's suspicious, and what to look at next. |
| Copy JSON | Copies the event as it was stored. |
Built-in fields
Whatever your shipper sends, every event has four built-in fields that you can filter on:
| Field | Where it comes from |
|---|---|
| source | The ingest key the event arrived on, shown by the key's source label. You can't set it from the shipper. |
| host | The first of these in the event: host (a string, or an object with name or hostname), hostname, host.name, computer. |
| event_type | The first of these in the event: event_type, eventType, eventName, event.action, action, type, EventID. |
| time | The event's own timestamp, from the first of time, timestamp, @timestamp, ts, eventTime that can be read as a time. ISO 8601 and epoch seconds, milliseconds, microseconds or nanoseconds all work. If none of them can be read, it's the time Huntbase received the event. |
All other fields keep the names they were sent with. Nested objects are flattened to dot paths, so a filter on process.parent.name matches both a nested object and a literal process.parent.name key.
The time range, the volume strip and the paging all use the time Huntbase received each event, not the event's own timestamp. The two are usually seconds apart. If a shipper sends a backlog late, those events appear in the window in which they arrived.
Show as query
Show as query switches the tab to Query mode with the query your view compiles to. The query uses KQL (Huntbase Lake), and the time window is set to match. The text you see is the text that runs. Browse reads its events with that same query, so Run returns the same events as an ordinary run, with run history, export and everything else a query run has.
A note under the bar reads Built from your Browse filters. Edit freely — Run executes exactly this query. After you edit the query, the note changes to Edited. Going back to Browse starts again from your last filters. A query can't be turned back into filters. If you return to Browse after editing, you're back on your last filters, and a notice says so.
Save a view
Save view asks for a Name, which defaults to a summary of the view, and adds the view to your saved queries. The saved query holds both the view and the query it compiles to:
- Opening it returns you to this view in Browse.
- Anything that uses saved queries, such as Schedules, uses the compiled query.
Live tail
Click Live tail to stream new events into the view as they arrive, with your filters applied. New events are highlighted at the top of the list, and the button shows Live. While tailing:
- The results header shows ● Streaming. If more than 50 events a second match, some aren't shown, and the header says how many were dropped. Narrow the view to see them all.
- A tail pauses while its tab is hidden (Paused) and picks up again when you come back. If the connection drops, it shows Reconnecting….
Live tail has two limits:
- Huntbase data lake only. Sources that write to your own lake can't be tailed. If the view includes one, the button turns off and explains why. Pick Huntbase data lake sources to tail.
- One tail per person. If a tail is already open in another tab or window, close it and try again.
When Browse can't show everything
Browse doesn't let an incomplete view pass as complete. When something is missing, a notice appears above the events:
| Notice | What it means | What to do |
|---|---|---|
| Store name isn't in these results / N lake stores aren't in these results | A lake store that these sources write to is excluded from federation, for the reason listed. Its events are missing from the counts and the rows. | Fix in Connections takes you to the fix. See In federation, or excluded. |
| This view would scan too much of your lake | Reading the view from your own lake would go over today's scan budget. | Narrow to the last hour, or pick fewer sources. An admin sets the budget; see Capabilities. |
| The data lake didn't answer in time | The lake timed out or is briefly unavailable. | Try again, or narrow the time range to make the read smaller. |
| You can't browse telemetry in this scope | Browsing needs permission to list ingest keys. | Ask an admin, or switch scope. |
If nothing matches, Browse offers Clear filters. If nothing arrived in the window, it offers Look at the last 24 hours. With no sources at all, Set up a source takes you to Connections.
Next steps
- Connections: check that each source is sending, and fix the ones that aren't
- Data lake: mint an ingest key and configure your shipper
- Scout and your telemetry: ask Scout about the view you're looking at
- Hunts: pin a view to a hunt as evidence