Is there a CSS or other parameter that can be set for the Sideview Table module to word wrap after a certain width? I have some fields that have particularly long content, such as suspicious / malicious URLs and the wrap default sometimes requires scrolling. Thanks. ... View more

I have a requirement to route data that falls within two /24 CIDR ranges to a separate index, say 10.0.1.0/24 and 10.0.2.0/24. The event traffic does not come from a specific host, however, all of our traffic does aggregate to a common heavy forwarder. The events coming in are either XML or syslog and each has a specific field that displays the IP, either source or destination such as or . My thought was to use transforms.conf and props.conf to route the traffic, but I'm not sure how to specify to only route to this index if the IP falls within the two desired /24 CIDR blocks. Thanks. ... View more

I've implemented tables with multiple pulldowns - TimeRangePicker and a custom Pulldown for setting span between events. I'm trying to use ValueSetter to maintain the value of these Pulldowns so when the dashboard refreshes the values remain set for the analysts. The ValueSetter config I have for the span Pulldown does not seem to be maintaining its value. Can someone see the mistake? I've also tried changing the token name just in case using the same token name for the Pulldown and ValueSetter was interferring, but no dice. The below is hand-jammed and copied from word, so some of the formatting doesn't line up. Thanks! <view autoCancelInterval="90" isSticky="False" onunloadCancelJobs="true" template="dashboard.html"> <label>Testing Sideview</label> <module name="AccountBar" layoutPanel="appHeader" /> <module name="AppBar" layoutPanel="appHeader" /> <module name="SideviewUtils" layoutPanel="appHeader" /> <module name=”TimeRangePicker” layoutPanel=”panel1_row1_col1” autoRun=”True”> <param name=”searchWhenChanged”>True</param> <param name=”default”>Last 24 hours</param> <module name=”Pulldown” layoutPanel=”panel1_row1_col1”> <param name=”name”>span</param> <param name=”label”>Event Span</param> <param name=”staticOptions”> <list> <param name=”label”>All</param> <param name=”value”>*</param> </list> <list> <param name=”label”>1 hour</param> <param name=”value”>1h</param> </list> </param> <module name=”ValueSetter”> <param name=”name”>span</param> <param name=”value”>$span</param> <module name="TextField" layoutPanel="panel_row1_col1" autoRun="True"> <param name="name">wild</param> <param name="float">left</param> <param name="label">Search</param> <param name="default">*</param> <module name="Search"> <param name=”search”>`Test_Macro(wild=”$wild$”,span=$span$)` | eval Acknowledge="" | lookup myLookup myIdField OUTPUT state</param> <param name="earliest">-1d</param> <param name="latest">now</param> <module name="Pager"> <module name="Table"> <module name="ValueSetter" group="row.fields.Acknowledge"> <param name="name">state</param> <param name="value">$row.fields.state$</param> <module name="Checkbox"> <param name="name">state</param> <param name="onValue">ack</param> <param name="offValue"></param> <module name="Search"> <param name="search">| inputlookup myLookup | append [stats count | fields - count | eval myIdField="$row.fields.myIdField$" | eval state="$state$"] | stats last(state) as state by myIdField | outputlookup myLookup</param> <module name="CustomBehavior"> <param name="requiresDispatch">True</param> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </view> ... View more