topic How can I add link to external WHOIS resource? in Dashboards & Visualizations

How can I add link to external WHOIS resource?

digital_alchemy — Wed, 12 Apr 2017 20:01:25 GMT

I'm trying to create column with a link to WHOIS for the results of a search but I'm running into an error indicating that the "field" attribute is deprecated, any ideas on how to correct this?

A quick search didn't reveal a working solution.

Warning on line 9: Attribute "field" is deprecated

<dashboard>
  <label>*** Test WHOIS ***</label>
  <row>
    <panel>
      <table>
        <search ref="DMZ Inbound Traffic Greater Than 2 Std Deviations Over Mean">
        </search>
        <drilldown target="_blank">
          <link field="WHOIS">
            <![CDATA[ http://who.is/whois-ip/ip-address/$row.src_ip$ ]]>
          </link>
        </drilldown>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="count">30</option>
      </table>
    </panel>
  </row>
</dashboard>

Re: How can I add link to external WHOIS resource?

jeffland — Thu, 13 Apr 2017 09:50:18 GMT

You can put a condition around your link that checks which column is clicked:

<drilldown>
  <condition field="WHOIS">
    <link target="_blank">
         <![CDATA[ http://who.is/whois-ip/ip-address/$row.src_ip$ ]]>
    </link>
  </condition>
</drilldown>

See docs here.

Re: How can I add link to external WHOIS resource?

digital_alchemy — Thu, 13 Apr 2017 21:27:37 GMT

I don't have an error after the changes but it also doesn't seem to provide a link to a WHOIS lookup.

Re: How can I add link to external WHOIS resource?

jeffland — Tue, 18 Apr 2017 10:59:44 GMT

It should, the error has to be somewhere else then. See the following run-anywhere dashboards, one with an inline search:

<dashboard>
  <label>_temp drilldown link</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval WHOIS="foo" | eval src_ip="bar"</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <drilldown>
          <condition field="WHOIS">
            <link target="_blank">
              <![CDATA[ http://google.com/search?q=$row.src_ip$ ]]>
            </link>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

and same with a report:

<dashboard>
  <label>_temp drilldown link</label>
  <row>
    <panel>
      <table>
        <search ref="_temp report"></search>
        <drilldown>
          <condition field="WHOIS">
            <link target="_blank">
              <![CDATA[ http://google.com/search?q=$row.src_ip$ ]]>
            </link>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Both work for me.