I have created a dashboard panel which displays events from a firewall log. Importantly, this panel is intended to show a request within the context of other requests around it. Filtering isn't desirable, as that removes the request from the context.
the dashboard uses the search:
[ search index=firewall
src_ip=$src$
dest_ip=$dest$ |
eval earliest = min(_time)-60 |
eval latest = max(_time)+60
| table earliest, latest ]
index=firewall dest_zone=external src_ip=$src$
| sort _time asc
| table _time src_ip dest_ip InitiatorPackets InitiatorBytes ResponderPackets ResponderBytes URL SSLServerName URLReputation URLCategory sourcetype
This search can result in many rows and the panel paginates them as expected. However, because the panel is displaying results from both before and after the event in question, that event is likely to end up somewhere in the middle of the results and on a page after the first. Is it possible to search within these results and have the panel automatically jump to the page where the expected result is displayed? E.g. if the request with the matching $src$ and $dest ip addresses is on page 3, then after the panel loads the data, it auto-navigates to page 3?
As a secondary question, is it possible to add a search box to the panel which would allow searching within the table and jumping the panel to the page with the expected result? E.g. I have some sort of text box above just that panel. If I type 'foobar.com' in the textbox, the panel jumps to the first page where 'foobar.com' is seen in the SSLServerName column?
