Simpler and pure Simple XML solution would be to add a drilldown capability on IP field.
Alternatively (what I did) - create a another field right next to IP, name it "Whois" and make click on this field to open new browser tab to execute "whois" on IP.
Such as:
...
<row>
<panel>
<table>
<title>Investigation Results</title>
<searchPostProcess base="root_search">
...
</searchPostProcess>
<drilldown target="_blank">
<link field="Whois">
<![CDATA[ http://who.is/whois-ip/ip-address/$row.src_ip$ ]]>
</link>
</drilldown>
<option name="rowNumbers">false</option>
<option name="drilldown">cell</option>
<option name="count">15</option>
</table>
</panel>
</row> ...
In above case - clicking on "Whois" field will open new browser tab where value of "src_ip" field will be taken and sent as a parameter to "who.is" service. Feel free to replace this with another service of your choice.
Simpler and pure Simple XML solution would be to add a drilldown capability on IP field.
Alternatively (what I did) - create a another field right next to IP, name it "Whois" and make click on this field to open new browser tab to execute "whois" on IP.
Such as:
...
<row>
<panel>
<table>
<title>Investigation Results</title>
<searchPostProcess base="root_search">
...
</searchPostProcess>
<drilldown target="_blank">
<link field="Whois">
<![CDATA[ http://who.is/whois-ip/ip-address/$row.src_ip$ ]]>
</link>
</drilldown>
<option name="rowNumbers">false</option>
<option name="drilldown">cell</option>
<option name="count">15</option>
</table>
</panel>
</row> ...
In above case - clicking on "Whois" field will open new browser tab where value of "src_ip" field will be taken and sent as a parameter to "who.is" service. Feel free to replace this with another service of your choice.
Thank you very much I will give it a shot and let you know how it goes.