topic Re: Is it possible to have multiple possibility of drilldown, based on the same field ? in Knowledge Management

Is it possible to have multiple possibility of drilldown, based on the same field ?

bugnet — Sun, 23 Apr 2017 10:05:25 GMT

hi all,
Is it possible to have multiple possibility of drilldown, based on the same field ?
I have table with a column "source_ip". I need to open a few options when clicking on the source IP address - for example 1.Blocke IP 2.Release IP

My existing drilldown allows me only to open one link.

<drilldown>
           <link>
          http://192.168.1.1/blockscript?ip=$row.source_ip$
            </link>
 </drilldown>

How could I achieve that ?

Re: Is it possible to have multiple possibility of drilldown, based on the same field ?

woodcock — Sun, 23 Apr 2017 22:32:57 GMT

Have you looked at workflow actions? Unfortunately these do not work in table visualization panels but they DEFINITELY should (please somebody open an ER).

http://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Knowledge/CreateworkflowactionsinSplunkWeb

Re: Is it possible to have multiple possibility of drilldown, based on the same field ?

niketn — Mon, 24 Apr 2017 04:04:51 GMT

Can you add two column to each row of output in your table?

<YourBaseSearchToPrintTableWithSourceIP>
| eval Blocked="Blocked IP"
| eval Source="Source IP"

Then code your drilldown based on which column was clicked and pick up the $row.source_ip$ for both with different base URLs as per your need when a row in either Blocked or Source IP column is clicked.

     <condition field="Blocked">
        <link>
              http://192.168.1.1/blockscript?ip=$row.source_ip$
         </link>
     </condition>
     <condition field="Source">
        <link>
              http://<AnotherURL>?ip=$row.source_ip$
         </link>
     </condition>

Re: Is it possible to have multiple possibility of drilldown, based on the same field ?

bugnet — Wed, 26 Apr 2017 06:29:41 GMT

Not so helpful to me. More ideas?