How to populate the events in active channel from datamonitor
I looking how to populate the events in active channel from data monitor/ dashboard, my concern is when I click the event in a data monitor/dashboard it has to appear in the active channel but somehow it is not working. How can I do it please guide is there is a way or any document to be follow.
It is highly appreciable if anyone can help in this,
It depends on the data monitor (DM). Some automatically bring up an active channel, and some do not.
Which DM are you expecting to create an active channel?
One way to tell if it will create an active channel when you click on the DM is to edit the DM and see if there is an attribute/setting for a field set. It there is, it will create an active channel. If there is not, it probably won't.
it's pretty simple, create an Active Channel with Generator URI starts with (or = if you want to have a specific monitor) ... and specify the path:
I asking like I m having a Dashboard which represents the top attacker IP's and their count, so when I click over the 1st IP with the highest count then that should be drill down to a active channel.
The way you suggested is useful when we are looking for a single event particularly but I want that however I click to and event in the dashboard it will drill down to a active channel.
Thanks for sharing your input its useful too.
Which dashboard are you using? Is it a default one which isn't working or custom dash created by you?
Before troubleshooting further, make sure you have assigned a field set in the respective data monitor by editing it..
Sent from my iPhone
Maybe what you want to do is populate an active list? If I understood correctly what you should do is create a lightweight rule that populates an active list with specific fields that you want.
If you're just looking for a specific event (event_name, IP, etc.), you can always right click on dashboard and click investigate in order to create an active channel and then add anything else you want to in the current filter. That's pretty obvious but sometimes the easiest way may be the solution.
No she doesn't want populate an active list but just a simple question about opening a active channel by double clicking on any dashboard, it normally shows up all respective events.
OK!! Your problem is that you can't use the InActiveList in an active channel. What you want to do can't be done. Sorry for misunderstanding earlier but this is an arcsight issue that doesn't let you use any active lists included as conditions in an active channel.
Actually, if your active list has key fields, you can use a getActiveList function (variable) to replace the inActiveList condition (getMyAcitveList.key1 IS NOT NULL), and then your active channel drill-down will work.