I am attempting to embed a pulldown menu into every row of a table in order to allow for follow-on actions for a specific field. The search and resulting table outputs "ip" (the field I am interested in) and "domain," but I cannot get the pulldown to populate with those values. My desired output would look like this for a given row:
ip
domain
actions
8.8.8.8
google.com
Action 1 for 8.8.8.8 Action 2 for 8.8.8.8 Action 3 for 8.8.8.8
192.168.1.1
localhost
Action 1 for 192.168.1.1 Action 2 for 192.168.1.1 Action 3 for 192.168.1.1
I feel like this should be pretty straightforward, however, the pulldown module (which is downstream) is not passing the $row.fields.ip$ token and instead outputs looks like this:
ip
domain
actions
8.8.8.8
google.com
Action 1 for $row.fields.ip$ Action 2 for $row.fields.ip$ Action 3 for $row.fields.ip$
192.168.1.1
localhost
Action 1 for $row.fields.ip$ Action 2 for $row.fields.ip$ Action 3 for $row.fields.ip$
The XML for my dashboard looks like so:
<module name="Search" layoutPanel="panel_row3_col1" autoRun="True">
<param name="search">
index=ioc_sample | stats count by ip | eval actions="PLACEHOLDER" | fields ip,domain,actions
</param>
<param name="earliest">0</param>
<param name="latest">now</param>
<module name="Pager">
<param name="count">5</param>
<module name="Table">
<module name="Pulldown" group="row.fields.actions">
<param name="staticOptions">
<list>
<param name="label">Additional Actions</param>
<param name="value">*</param>
<param name="selected">True</param>
</list>
<list>
<param name="value">$row.fields.ip$</param>
<param name="label">Action 1 for $row.fields.ip$</param>
</list>
<list>
<param name="value">$row.fields.ip$</param>
<param name="label">Action 2 for $row.fields.ip$</param>
</list>
</param>
</module>
</module>
</module>
</module>
The modules flow downstream correctly, and I can pass tokens correctly in other modules embedded within the pulldown module so I do not know where things are breaking. Ideas?
... View more