2 Replies Latest reply on Dec 12, 2013 3:13 PM by acommons

    Displaying watchlist contents in a panel in a View

    acommons

      Hi,

       

      I'm building a View where all the panels are based on a watchlist (type IP address) that is populated by an alarm with the entries having a timeout set (this is ESM 9.3.1). The various panels in the view are representing selected event fields from a variety of event sources.

       

      What I would like to be able to do is bind all the panels to a single base display that contains the IP addresses. This allows me to select one or more IP addresses and get all the events filtered for those IPs. Yes, I know I can do this using the filter panel but this requires me to know which IP addresses are in the watchlist or at least represented in at least one of the display panels.

       

      I seem to have two ways to approach this:

       

      1. Build a List panel that combines the filters on all the other panels in the View to display the IP addresses in the View.
      2. Have a panel that lists the contents of the Watchlist and bind everything to that.

       

      The first option is certainly possible but would get complicated as the View gets more complex. The second option looks perfect but I have no idea how I can do it.

       

      So is it possible to create a panel that just lists the contents of a watchlist and bind other panels to it?

       

      cheers,

      Andrew

        • 1. Re: Displaying watchlist contents in a panel in a View
          kcole

          If I am understanding your question correctly, you can provide a view using a component like the bar chart with the following settings:

          1. Select that you want to use Source IP as your query

          2. In the filter option, select the filter next to source IP and choose the watchlist you want to use. 

           

          Your results should be similar to the following:

           

          A list of all the IPs in the watchlist that have events associated to them.  Then you can bind additional components off this list as needed. 

           

          Screen Shot 2013-12-12 at 11.45.14 AM (2).png

          • 2. Re: Displaying watchlist contents in a panel in a View
            acommons

            Yup. I was too focused on the specifics and missed the sledge hammer

             

            I guess the only possible downside will be performance since I'm now running a pretty big query to drive another 15 queries. But it shoud do it

             

            Thanks!

             

            cheers,

            Andrew