I'm trying to create column with a link to WHOIS for the results of a search but I'm running into an error indicating that the "field" attribute is deprecated, any ideas on how to correct this?
A quick search didn't reveal a working solution.
Warning on line 9: Attribute "field" is deprecated
<dashboard>
<label>*** Test WHOIS ***</label>
<row>
<panel>
<table>
<search ref="DMZ Inbound Traffic Greater Than 2 Std Deviations Over Mean">
</search>
<drilldown target="_blank">
<link field="WHOIS">
<![CDATA[ http://who.is/whois-ip/ip-address/$row.src_ip$ ]]>
</link>
</drilldown>
<option name="rowNumbers">false</option>
<option name="drilldown">cell</option>
<option name="count">30</option>
</table>
</panel>
</row>
</dashboard>
You can put a condition around your link that checks which column is clicked:
<drilldown>
<condition field="WHOIS">
<link target="_blank">
<![CDATA[ http://who.is/whois-ip/ip-address/$row.src_ip$ ]]>
</link>
</condition>
</drilldown>
See docs here.
I don't have an error after the changes but it also doesn't seem to provide a link to a WHOIS lookup.
It should, the error has to be somewhere else then. See the following run-anywhere dashboards, one with an inline search:
<dashboard>
<label>_temp drilldown link</label>
<row>
<panel>
<table>
<search>
<query>| makeresults | eval WHOIS="foo" | eval src_ip="bar"</query>
<earliest>0</earliest>
<latest></latest>
</search>
<drilldown>
<condition field="WHOIS">
<link target="_blank">
<![CDATA[ http://google.com/search?q=$row.src_ip$ ]]>
</link>
</condition>
</drilldown>
</table>
</panel>
</row>
</dashboard>
and same with a report:
<dashboard>
<label>_temp drilldown link</label>
<row>
<panel>
<table>
<search ref="_temp report"></search>
<drilldown>
<condition field="WHOIS">
<link target="_blank">
<![CDATA[ http://google.com/search?q=$row.src_ip$ ]]>
</link>
</condition>
</drilldown>
</table>
</panel>
</row>
</dashboard>
Both work for me.