topic Re: condition drilldown - with link target in Splunk Search

condition drilldown - with link target

anissabnk — Tue, 10 Dec 2024 05:33:30 GMT

Hello,

I want to make a drilldown with those services : and I have to apply a drilldow for (s3-bucket / vpc / ec2)

I've tried several things but nothing works

<row>
<panel>
<title>AWS Services Monitoring</title>
<table>
<search>

<query>index="aws_vpc_corp-it_security-prd" sourcetype="aws:s3:csv" ShortConfigRuleName="*"
| eval Services = case(
match(ShortConfigRuleName, "s3-bucket"), "s3-bucket",
match(ShortConfigRuleName, "iam-password"), "iam-password",
match(ShortConfigRuleName, "iam-policy"), "iam-policy",
match(ShortConfigRuleName, "iam-user"), "iam-user",
match(ShortConfigRuleName, "guardduty"), "guardduty",
match(ShortConfigRuleName, "ec2"), "ec2",
match(ShortConfigRuleName, "vpc"), "vpc",
match(ShortConfigRuleName, "ebs-snapshot"), "ebs-snapshot",
match(ShortConfigRuleName, "rds-snapshots"), "rds-snapshots",
match(ShortConfigRuleName, "cloudtrail"), "cloudtrail",
match(ShortConfigRuleName, "subnet"), "subnet",
match(ShortConfigRuleName, "lambda-function"), "lambda-function",
1=1, "Other")
|search Services!=Other
| lookup aws_security_all_account_ids account_id AS AccountId OUTPUT name
| table name AccountId Services ShortConfigRuleName ComplianceType OrderingTimestamp ResultRecordedTime
| dedup AccountId Services ShortConfigRuleName ComplianceType | rename name as "AWS Account Name", "ComplianceType" as "Status", "OrderingTimestamp" as "Last Check", "ResultRecordedTime" as "Next Check"
|fillnull value="N/A"
|search $ResourceName$ $Services$ $Status$</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="count">100</option>
<option name="drilldown">row</option>
<option name="refresh.display">progressbar</option>
<option name="wrap">true</option>
<format type="color" field="Status">
<colorPalette type="map">{"NON_COMPLIANT":#D94E17}</colorPalette>
</format>
<drilldown>
<condition match="$Services$ != "s3-bucket"">
<set token="Services">s3-bucket</set>
<link target="_blank">/app/search/dev_vwt_dashboards_uc48_details?ShortConfigRuleName=$row.ShortConfigRuleName$&AccountId=$row.AccountId$&Services=$row.Services$&S3_details=true&earliest=$earliest$&latest=$latest$&Status=$row.Status$</link>
</condition>

<condition match="$Services$ != "vpc"">
<set token="Services">vpc</set>
<link target="_blank">/app/search/dev_vwt_dashboards_uc48_details?ShortConfigRuleName=$row.ShortConfigRuleName$&AccountId=$row.AccountId$&Services=$row.Services$&VPC_details=true&earliest=$earliest$&latest=$latest$&Status=$row.Status$</link>
</condition>

<condition match="$Services$ != "ec2"">
<set token="Services">ec2</set>
<link target="_blank">/app/search/dev_vwt_dashboards_uc48_details?ShortConfigRuleName=$row.ShortConfigRuleName$&AccountId=$row.AccountId$&Services=$row.Services$&EC2_details=true&earliest=$earliest$&latest=$latest$&Status=$row.Status$</link>
</condition>
</drilldown>
</table>
</panel>
</row>

The drilldown is supposed to ‘point’ to a second dashboard in the following way:

</panel>
<panel depends="$VPC_details$">
<title>VPC DETAILS : ShortConfigRuleName=$ShortConfigRuleName$ Service=$Services$</title>
<table>
<search>
<query>index="aws_vpc_corp-it_security-prd"
| search ShortConfigRuleName=$ShortConfigRuleName$
|search AccountId=$AccountId$
|search ComplianceType=$Status$
| eval Services = case(
match(ShortConfigRuleName, "s3-bucket"), "s3-bucket",
match(ShortConfigRuleName, "iam-password"), "iam-password",
match(ShortConfigRuleName, "iam-policy"), "iam-policy",
match(ShortConfigRuleName, "iam-user"), "iam-user",
match(ShortConfigRuleName, "guardduty"), "guardduty",
match(ShortConfigRuleName, "ec2"), "ec2",
match(ShortConfigRuleName, "vpc"), "vpc",
match(ShortConfigRuleName, "ebs-snapshot"), "ebs-snapshot",
match(ShortConfigRuleName, "rds-snapshots"), "rds-snapshots",
match(ShortConfigRuleName, "cloudtrail"), "cloudtrail",
match(ShortConfigRuleName, "subnet"), "subnet",
match(ShortConfigRuleName, "lambda-function"), "lambda-function",
1=1, "Other")
| where ResourceName!="N/A"
| table AccountId ResourceName Services ComplianceType
|rename ResourceName as "InstanceName"
| table AccountId Services ComplianceType
| dedup AccountId Services ComplianceType
|appendcols
[ search index="aws_vpc_corp-it_security-prd" source="s3://vwt-s3-secuprod-*" |search AccountId=$AccountId$
|table InstanceId InstanceName Platform State |dedup InstanceId InstanceName Platform State]
| table AccountId Services ComplianceType InstanceId InstanceName Platform State</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="count">100</option>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="ComplianceType">
<colorPalette type="map">{"NON_COMPLIANT":#D94E17}</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="map">{"stopped":#D94E17,"running":#55C169}</colorPalette>
</format>
<drilldown>
<condition>

<eval token="S3_details">if(match($click.value$, "s3-bucket"), "true", "false")</eval>
<eval token="VPC_details">if(match($click.value$, "vpc"), "true", "false")</eval>
<eval token="EC2_details">if(match($click.value$, "ec2"), "true", "false")</eval>
</condition>
</drilldown>
</table>
</panel>
<panel depends="$EC2_details$">
<title>EC2 DETAILS : ShortConfigRuleName=$ShortConfigRuleName$ Service=$Services$</title>
<table>
<search>
<query>index="aws_vpc_corp-it_security-prd"
| search ShortConfigRuleName=$ShortConfigRuleName$
|search AccountId=$AccountId$
|search ComplianceType=$Status$
| eval Services = case(
match(ShortConfigRuleName, "s3-bucket"), "s3-bucket",
match(ShortConfigRuleName, "iam-password"), "iam-password",
match(ShortConfigRuleName, "iam-policy"), "iam-policy",
match(ShortConfigRuleName, "iam-user"), "iam-user",
match(ShortConfigRuleName, "guardduty"), "guardduty",
match(ShortConfigRuleName, "ec2"), "ec2",
match(ShortConfigRuleName, "vpc"), "vpc",
match(ShortConfigRuleName, "ebs-snapshot"), "ebs-snapshot",
match(ShortConfigRuleName, "rds-snapshots"), "rds-snapshots",
match(ShortConfigRuleName, "cloudtrail"), "cloudtrail",
match(ShortConfigRuleName, "subnet"), "subnet",
match(ShortConfigRuleName, "lambda-function"), "lambda-function",
1=1, "Other")
| where ResourceName!="N/A"
| table AccountId ResourceName Services ComplianceType
|rename ResourceName as "InstanceName"
| table AccountId Services ComplianceType
| dedup AccountId Services ComplianceType
|appendcols
[ search index="aws_vpc_corp-it_security-prd" source="s3://vwt-s3-secuprod-*" |search AccountId=$AccountId$
|table InstanceId InstanceName Platform State |dedup InstanceId InstanceName Platform State]
| table AccountId Services ComplianceType InstanceId InstanceName Platform State</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="count">100</option>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="ComplianceType">
<colorPalette type="map">{"NON_COMPLIANT":#D94E17}</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="map">{"stopped":#D94E17,"running":#55C169}</colorPalette>
</format>
<drilldown>
<condition>

<eval token="S3_details">if(match($click.value$, "s3-bucket"), "true", "false")</eval>
<eval token="VPC_details">if(match($click.value$, "vpc"), "true", "false")</eval>
<eval token="EC2_details">if(match($click.value$, "ec2"), "true", "false")</eval>
</condition>
</drilldown>
</table>
</panel>
<panel depends="$SERVICES_details$">
<title>SERVICES DETAILS : ShortConfigRuleName=$ShortConfigRuleName$ Service=$Services$</title>
<table>
<search>
<query>index="aws_vpc_corp-it_security-prd"
| search ShortConfigRuleName=$ShortConfigRuleName$
|search AccountId=$AccountId$
|search ComplianceType=$Status$
| eval Services = case(
match(ShortConfigRuleName, "s3-bucket"), "s3-bucket",
match(ShortConfigRuleName, "iam-password"), "iam-password",
match(ShortConfigRuleName, "iam-policy"), "iam-policy",
match(ShortConfigRuleName, "iam-user"), "iam-user",
match(ShortConfigRuleName, "guardduty"), "guardduty",
match(ShortConfigRuleName, "ec2"), "ec2",
match(ShortConfigRuleName, "vpc"), "vpc",
match(ShortConfigRuleName, "ebs-snapshot"), "ebs-snapshot",
match(ShortConfigRuleName, "rds-snapshots"), "rds-snapshots",
match(ShortConfigRuleName, "cloudtrail"), "cloudtrail",
match(ShortConfigRuleName, "subnet"), "subnet",
match(ShortConfigRuleName, "lambda-function"), "lambda-function",
1=1, "Other")
| where ResourceName!="N/A"
| table AccountId ResourceName Services ComplianceType
|rename ResourceName as "InstanceName"
| table AccountId Services ComplianceType
| dedup AccountId Services ComplianceType
|appendcols
[ search index="aws_vpc_corp-it_security-prd" source="s3://vwt-s3-secuprod-*" |search AccountId=$AccountId$
|table InstanceId InstanceName Platform State |dedup InstanceId InstanceName Platform State]
| table AccountId Services ComplianceType InstanceId InstanceName Platform State</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="count">100</option>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="ComplianceType">
<colorPalette type="map">{"NON_COMPLIANT":#D94E17}</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="map">{"stopped":#D94E17,"running":#55C169}</colorPalette>
</format>
<drilldown>
<condition>

<eval token="S3_details">if(match($click.value$, "s3-bucket"), "true", "false")</eval>
<eval token="VPC_details">if(match($click.value$, "vpc"), "true", "false")</eval>
<eval token="EC2_details">if(match($click.value$, "ec2"), "true", "false")</eval>
</condition>
</drilldown>
</table>
</panel>
</row>

When s3-bucket is selected, we point to the ‘S3_details’ panel, and so on

The link target works fine, but it's the click value at the beginning with the service selection that doesn't work

Re: condition drilldown - with link target

bowesmana — Sun, 08 Dec 2024 22:31:28 GMT

Do you mean in the second dashboard, there are inputs which are not selected as you wanted?

If so, it's probably because the input token is named form.xxx, so if your input dropdown for Services is the token ShortConfigRuleName, then you should pass the URL with

form.ShortConfigRuleName=$row.ShortConfigRuleName$

Re: condition drilldown - with link target

anissabnk — Mon, 09 Dec 2024 22:24:27 GMT

Hello,

Than your for your answer but it doesn't work.

panel 1 :

<row> <panel> <title>AWS Services Monitoring</title> <table> <search>  <query>index="aws_vpc_corp-it_security-prd" sourcetype="aws:s3:csv" ShortConfigRuleName="*" | eval Services = case( match(ShortConfigRuleName, "s3-bucket"), "s3-bucket", match(ShortConfigRuleName, "iam-password"), "iam-password", match(ShortConfigRuleName, "iam-policy"), "iam-policy", match(ShortConfigRuleName, "iam-user"), "iam-user", match(ShortConfigRuleName, "guardduty"), "guardduty", match(ShortConfigRuleName, "ec2"), "ec2", match(ShortConfigRuleName, "vpc"), "vpc", match(ShortConfigRuleName, "ebs-snapshot"), "ebs-snapshot", match(ShortConfigRuleName, "rds-snapshots"), "rds-snapshots", match(ShortConfigRuleName, "cloudtrail"), "cloudtrail", match(ShortConfigRuleName, "subnet"), "subnet", match(ShortConfigRuleName, "lambda-function"), "lambda-function", 1=1, "Other") |search Services!=Other | lookup aws_security_all_account_ids account_id AS AccountId OUTPUT name | table name AccountId Services ShortConfigRuleName ComplianceType OrderingTimestamp ResultRecordedTime | dedup AccountId Services ShortConfigRuleName ComplianceType | rename name as "AWS Account Name", "ComplianceType" as "Status", "OrderingTimestamp" as "Last Check", "ResultRecordedTime" as "Next Check" |fillnull value="N/A" |search $ResourceName$ $Services$ $Status$</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="count">100</option> <option name="drilldown">row</option> <option name="refresh.display">progressbar</option> <option name="wrap">true</option> <format type="color" field="Status"> <colorPalette type="map">{"NON_COMPLIANT":#D94E17}</colorPalette> </format> <drilldown> <condition match="$row.Services$ != "s3-bucket""> <link target="_blank">/app/search/dev_vwt_dashboards_uc48_details?ShortConfigRuleName=$row.ShortConfigRuleName$&AccountId=$row.AccountId$&Services=$row.Services$&S3_details=true&earliest=$earliest$&latest=$latest$&Status=$row.Status$</link> </condition> <condition match="$row.Services$ != "vpc""> <link target="_blank">/app/search/dev_vwt_dashboards_uc48_details?ShortConfigRuleName=$row.ShortConfigRuleName$&AccountId=$row.AccountId$&Services=$row.Services$&VPC_details=true&earliest=$earliest$&latest=$latest$&Status=$row.Status$</link> </condition> <condition match="$row.Services$ != "ec2""> <link target="_blank">/app/search/dev_vwt_dashboards_uc48_details?ShortConfigRuleName=$row.ShortConfigRuleName$&AccountId=$row.AccountId$&Services=$row.Services$&EC2_details=true&earliest=$earliest$&latest=$latest$&Status=$row.Status$</link> </condition> </drilldown> </table> </panel> </row>

panel 2:

<row> <panel depends="$S3_details$"> <title>S3 DETAILS : $row.Services$ $click.name2$ $click.value$ $click.value$ $click.value3$ $click.Services$</title> <table> <search> <query>index="aws_vpc_corp-it_security-prd" | search ShortConfigRuleName=$ShortConfigRuleName$ |search AccountId=$AccountId$ |search ComplianceType=$Status$ | eval Services = case( match(ShortConfigRuleName, "s3-bucket"), "s3-bucket", match(ShortConfigRuleName, "iam-password"), "iam-password", match(ShortConfigRuleName, "iam-policy"), "iam-policy", match(ShortConfigRuleName, "iam-user"), "iam-user", match(ShortConfigRuleName, "guardduty"), "guardduty", match(ShortConfigRuleName, "ec2"), "ec2", match(ShortConfigRuleName, "vpc"), "vpc", match(ShortConfigRuleName, "ebs-snapshot"), "ebs-snapshot", match(ShortConfigRuleName, "rds-snapshots"), "rds-snapshots", match(ShortConfigRuleName, "cloudtrail"), "cloudtrail", match(ShortConfigRuleName, "subnet"), "subnet", match(ShortConfigRuleName, "lambda-function"), "lambda-function", 1=1, "Other") | where ResourceName!="N/A" | table AccountId ResourceName Services ComplianceType |rename ResourceName as "InstanceName" | table AccountId Services ComplianceType | dedup AccountId Services ComplianceType |appendcols [ search index="aws_vpc_corp-it_security-prd" source="s3://vwt-s3-secuprod-*" |search AccountId=$AccountId$ |table InstanceId InstanceName Platform State |dedup InstanceId InstanceName Platform State] | table AccountId Services ComplianceType InstanceId InstanceName Platform State</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">100</option> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <format type="color" field="ComplianceType"> <colorPalette type="map">{"NON_COMPLIANT":#D94E17}</colorPalette> </format> <format type="color" field="State"> <colorPalette type="map">{"stopped":#D94E17,"running":#55C169}</colorPalette> </format> <drilldown> <condition>  <eval token="S3_details">if(match($click.value$, "s3-bucket"), "true", "false")</eval> <eval token="VPC_details">if(match($click.value$, "vpc"), "true", "false")</eval> <eval token="EC2_details">if(match($click.value$, "ec2"), "true", "false")</eval> </condition> </drilldown> </table> </panel> <panel depends="$VPC_details$"> <title>VPC DETAILS : $row.Services$ $click.name2$ $click.value$ $click.value$ $click.value3$ $click.Services$</title> <table> <search> <query>index="aws_vpc_corp-it_security-prd" | search ShortConfigRuleName=$ShortConfigRuleName$ |search AccountId=$AccountId$ |search ComplianceType=$Status$ | eval Services = case( match(ShortConfigRuleName, "s3-bucket"), "s3-bucket", match(ShortConfigRuleName, "iam-password"), "iam-password", match(ShortConfigRuleName, "iam-policy"), "iam-policy", match(ShortConfigRuleName, "iam-user"), "iam-user", match(ShortConfigRuleName, "guardduty"), "guardduty", match(ShortConfigRuleName, "ec2"), "ec2", match(ShortConfigRuleName, "vpc"), "vpc", match(ShortConfigRuleName, "ebs-snapshot"), "ebs-snapshot", match(ShortConfigRuleName, "rds-snapshots"), "rds-snapshots", match(ShortConfigRuleName, "cloudtrail"), "cloudtrail", match(ShortConfigRuleName, "subnet"), "subnet", match(ShortConfigRuleName, "lambda-function"), "lambda-function", 1=1, "Other") | where ResourceName!="N/A" | table AccountId ResourceName Services ComplianceType |rename ResourceName as "InstanceName" | table AccountId Services ComplianceType | dedup AccountId Services ComplianceType |appendcols [ search index="aws_vpc_corp-it_security-prd" source="s3://vwt-s3-secuprod-*" |search AccountId=$AccountId$ |table InstanceId InstanceName Platform State |dedup InstanceId InstanceName Platform State] | table AccountId Services ComplianceType InstanceId InstanceName Platform State</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">100</option> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <format type="color" field="ComplianceType"> <colorPalette type="map">{"NON_COMPLIANT":#D94E17}</colorPalette> </format> <format type="color" field="State"> <colorPalette type="map">{"stopped":#D94E17,"running":#55C169}</colorPalette> </format> <drilldown> <condition>  <eval token="S3_details">if(match($click.value$, "s3-bucket"), "true", "false")</eval> <eval token="VPC_details">if(match($click.value$, "vpc"), "true", "false")</eval> <eval token="EC2_details">if(match($click.value$, "ec2"), "true", "false")</eval> </condition> </drilldown> </table> </panel> <panel depends="$EC2_details$"> <title>EC2 DETAILS : $row.Services$ $click.name2$ $click.value$ $click.value$ $click.value3$ $click.Services$</title> <table> <search> <query>index="aws_vpc_corp-it_security-prd" | search ShortConfigRuleName=$ShortConfigRuleName$ |search AccountId=$AccountId$ |search ComplianceType=$Status$ | eval Services = case( match(ShortConfigRuleName, "s3-bucket"), "s3-bucket", match(ShortConfigRuleName, "iam-password"), "iam-password", match(ShortConfigRuleName, "iam-policy"), "iam-policy", match(ShortConfigRuleName, "iam-user"), "iam-user", match(ShortConfigRuleName, "guardduty"), "guardduty", match(ShortConfigRuleName, "ec2"), "ec2", match(ShortConfigRuleName, "vpc"), "vpc", match(ShortConfigRuleName, "ebs-snapshot"), "ebs-snapshot", match(ShortConfigRuleName, "rds-snapshots"), "rds-snapshots", match(ShortConfigRuleName, "cloudtrail"), "cloudtrail", match(ShortConfigRuleName, "subnet"), "subnet", match(ShortConfigRuleName, "lambda-function"), "lambda-function", 1=1, "Other") | where ResourceName!="N/A" | table AccountId ResourceName Services ComplianceType |rename ResourceName as "InstanceName" | table AccountId Services ComplianceType | dedup AccountId Services ComplianceType |appendcols [ search index="aws_vpc_corp-it_security-prd" source="s3://vwt-s3-secuprod-*" |search AccountId=$AccountId$ |table InstanceId InstanceName Platform State |dedup InstanceId InstanceName Platform State] | table AccountId Services ComplianceType InstanceId InstanceName Platform State</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">100</option> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <format type="color" field="ComplianceType"> <colorPalette type="map">{"NON_COMPLIANT":#D94E17}</colorPalette> </format> <format type="color" field="State"> <colorPalette type="map">{"stopped":#D94E17,"running":#55C169}</colorPalette> </format> <drilldown> <condition>  <eval token="S3_details">if(match($click.value$, "s3-bucket"), "true", "false")</eval> <eval token="VPC_details">if(match($click.value$, "vpc"), "true", "false")</eval> <eval token="EC2_details">if(match($click.value$, "ec2"), "true", "false")</eval> </condition> </drilldown> </table> </panel> <panel depends="$SERVICES_details$"> <title>SERVICES DETAILS : $row.Services$ $click.name2$ $click.value$ $click.value$ $click.value3$ $click.Services$</title> <table> <search> <query>index="aws_vpc_corp-it_security-prd" | search ShortConfigRuleName=$ShortConfigRuleName$ |search AccountId=$AccountId$ |search ComplianceType=$Status$ | eval Services = case( match(ShortConfigRuleName, "s3-bucket"), "s3-bucket", match(ShortConfigRuleName, "iam-password"), "iam-password", match(ShortConfigRuleName, "iam-policy"), "iam-policy", match(ShortConfigRuleName, "iam-user"), "iam-user", match(ShortConfigRuleName, "guardduty"), "guardduty", match(ShortConfigRuleName, "ec2"), "ec2", match(ShortConfigRuleName, "vpc"), "vpc", match(ShortConfigRuleName, "ebs-snapshot"), "ebs-snapshot", match(ShortConfigRuleName, "rds-snapshots"), "rds-snapshots", match(ShortConfigRuleName, "cloudtrail"), "cloudtrail", match(ShortConfigRuleName, "subnet"), "subnet", match(ShortConfigRuleName, "lambda-function"), "lambda-function", 1=1, "Other") | where ResourceName!="N/A" | table AccountId ResourceName Services ComplianceType |rename ResourceName as "InstanceName" | table AccountId Services ComplianceType | dedup AccountId Services ComplianceType |appendcols [ search index="aws_vpc_corp-it_security-prd" source="s3://vwt-s3-secuprod-*" |search AccountId=$AccountId$ |table InstanceId InstanceName Platform State |dedup InstanceId InstanceName Platform State] | table AccountId Services ComplianceType InstanceId InstanceName Platform State</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">100</option> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <format type="color" field="ComplianceType"> <colorPalette type="map">{"NON_COMPLIANT":#D94E17}</colorPalette> </format> <format type="color" field="State"> <colorPalette type="map">{"stopped":#D94E17,"running":#55C169}</colorPalette> </format> <drilldown> <condition>  <eval token="S3_details">if(match($click.value$, "s3-bucket"), "true", "false")</eval> <eval token="VPC_details">if(match($click.value$, "vpc"), "true", "false")</eval> <eval token="EC2_details">if(match($click.value$, "ec2"), "true", "false")</eval> </condition> </drilldown> </table> </panel> </row>

But it does'nt work, when I select the vpc filter, I arrive at the S3_details view, instead of arriving at VPC_details when I select the s3-bucket filter, I go to VPC_details instead of S3_details
when I select the ec2 filter, I end up on S3_details instead of EC2_details

Re: condition drilldown - with link target

bowesmana — Mon, 09 Dec 2024 23:43:37 GMT

Look at your condition match statements, e.g. your first one does

and then it sets S3_details="true"

same for VPC and the other. So you probably want to change your matches to = rather than !=

Re: condition drilldown - with link target

anissabnk — Tue, 10 Dec 2024 15:13:42 GMT

<condition match="$Services$ == "vpc""> </condition>  <condition> <link target="_blank">/app/search/dev_vwt_dashboards_uc48_details?ShortConfigRuleName=$row.ShortConfigRuleName$&AccountId=$row.AccountId$&Services=$row.Services$&VPC_details=true&earliest=$earliest$&latest=$latest$&Status=$row.Status$</link> </condition>

I tried this but it doesn't work

Re: condition drilldown - with link target

bowesmana — Wed, 11 Dec 2024 02:30:48 GMT

Why did you do that? That's different to what you originally posted as well as changing the != to ==

Your original posted attempt was this

You just tried this

You changed both the match token AND the comparator.

You only need to change the comparator - it works fine.

Re: condition drilldown - with link target

anissabnk — Thu, 12 Dec 2024 10:46:48 GMT

This : <condition match="$row.Services$ == "s3-bucket""> works fine