Hi all, i need to change the destination of a report when clicking on the pie slice of a pie report.
the query that i'm using to create the pie is this:
sourcetype="webseal_access" OR sourcetype="wmi:wineventlog:security"| eval IP=case(sourcetype=="webseal_access", IP_Source, sourcetype=="wmi:wineventlog:security", Source_Network_Address) | search [search eventtype="searchIPS2" Direction="Inbound" Severity="Medium" DestinationIP=* | fields DestinationIP | rename DestinationIP as IP | dedup IP] | stats count by IP | sort count desc
It show a pie divided by IP with the count for each IP.
clicking on the slice of the pie it show the same query in another window with added IP="188.8.131.52". I need to insert automatically "| where " in this query before the IP="184.108.40.206"