hi all,
Is it possible to have multiple possibility of drilldown, based on the same field ?
I have table with a column "source_ip". I need to open a few options when clicking on the source IP address - for example 1.Blocke IP 2.Release IP
My existing drilldown allows me only to open one link.
<drilldown>
<link>
http://192.168.1.1/blockscript?ip=$row.source_ip$
</link>
</drilldown>
How could I achieve that ?
Not so helpful to me. More ideas?
Can you add two column to each row of output in your table?
<YourBaseSearchToPrintTableWithSourceIP>
| eval Blocked="Blocked IP"
| eval Source="Source IP"
Then code your drilldown based on which column was clicked and pick up the $row.source_ip$ for both with different base URLs as per your need when a row in either Blocked or Source IP column is clicked.
<condition field="Blocked">
<link>
http://192.168.1.1/blockscript?ip=$row.source_ip$
</link>
</condition>
<condition field="Source">
<link>
http://<AnotherURL>?ip=$row.source_ip$
</link>
</condition>
Have you looked at workflow actions
? Unfortunately these do not work in table
visualization panels but they DEFINITELY should (please somebody open an ER).
http://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Knowledge/CreateworkflowactionsinSplunkWeb