sideview the best answer you will get..... ... View more

Hello Anand, I do believe the Splunk app for Enterprise Security provides the functionality you are looking for. The app provides an 'Event Hash' of every event, which you can use to refer back to an exact event. Hope this helps. ... View more

After some emails, smolcj and I discovered that the reason this solution was being pursued was just to improve the general readability of the Table. That's to say the leftmost column was a really a header for the row, and the request had come in to space things out in the table so that the header was higher than the content. I made the suggestion of looking into the Embedding feature of the Table module, because it would be dead-simple to just embed HTML modules into the particular cells as necessary so that the 'data' cells had some padding on the top edge. And I hear that this has worked out well as the solution. Here's the code that smolcj used as a proof-of-concept, and if you haven't read the "Table - Custom Embedding" documentation in Sideview Utils, this will look a little odd. It basically takes all the "Connection" cells in the table and wraps each of them in a div that adds top padding so as to push down the data. If done to all of the "data" cells, it would make the leftmost cell of each row look like a header for that row. You could also use the same effect to wrap the leftmost values in <b> tags or anything you like. <module name="Search" layoutPanel="panel_row2_col1" autoRun="True"> <param name="search"><![CDATA[ index=infa sourcetype=session-log source=*SUCCESS* sess_trans_type=* | stats values(sess_trans_type) as Transtype, values(sess_connection) as Connection, values(sess_codepage) as Codepage, values(sess_sql_query) as Query by sess_trans_name ]]></param> <module name="Pager"> <param name="count">5</param> <module name="Table"> <param name="hiddenFields">Codepage,Query</param> <module name="HTML" group="row.fields.Connection"> <param name="html"><![CDATA[ <div style="padding-top:15px;width: 500px;"> Connection = <b>$row.fields.Connection$</b><br> Codepage = <b>$row.fields.Codepage$</b><br> </div> ]]></param> </module> </module> </module> </module> ... View more