Commodore
Commodore
1018 views

How to populate the events in active channel from datamonitor

Hello

@Richard Kent

I looking how to populate the events in active channel from data monitor/ dashboard, my concern is when I click the event in a data monitor/dashboard it has to appear in the active channel but somehow it is not working. How can I do it please guide is there is a way or any document to be follow.
It is highly appreciable if anyone can help in this,

Thanks,
Anchal

AJ
Labels (1)
Tags (1)
0 Likes
14 Replies
Commodore
Commodore


please help

AJ
0 Likes
Vice Admiral
Vice Admiral

It depends on the data monitor (DM). Some automatically bring up an active channel, and some do not.

Which DM are you expecting to create an active channel?

One way to tell if it will create an active channel when you click on the DM is to edit the DM and see if there is an attribute/setting for a field set. It there is, it will create an active channel. If there is not, it probably won't.

0 Likes
Fleet Admiral Fleet Admiral
Fleet Admiral

Hello,

it's pretty simple, create an Active Channel with Generator URI starts with (or = if you want to have a specific monitor) ... and specify the path:

Volker

0 Likes
Commodore
Commodore

Hi Volker,
I asking like I m having a Dashboard which represents the top attacker IP's and their count, so when I click over the 1st IP with the highest count then that should be drill down to a active channel.
The way you suggested  is useful when we are looking for a single event particularly but I want that however I click to and event in the dashboard it will drill down to a active channel.
Thanks for sharing your input its useful too.

AJ
0 Likes
Commodore
Commodore

Hello Prentice,
Can you provide me the screenshot or any steps how can I go with what you have suggested.
It will be helpful too.

AJ
0 Likes

Which dashboard are you using? Is it a default one which isn't working or custom dash created by you?

Before troubleshooting further, make sure you have assigned a field set in the respective data monitor by editing it..

Regards

Pushpendra

Sent from my iPhone

0 Likes
Absent Member.
Absent Member.

Maybe what you want to do is populate an active list? If I understood correctly what you should do is create a lightweight rule that populates an active list with specific fields that you want.

If you're just looking for a specific event (event_name, IP, etc.), you can always right click on dashboard and click investigate in order to create an active channel and then add anything else you want to in the current filter. That's pretty obvious but sometimes the easiest way may be the solution.

0 Likes

No she doesn't want populate an active list but just a simple question about opening a active channel by double clicking on any dashboard, it normally shows up all respective events.

0 Likes
Commodore
Commodore

Thanks for the valuable response to the problem ihope may ill be not very clear by the words below are the snaps please look to it:
datamonitor1.PNGMay thisDatamonitor.PNG

May this will help to understand better about what I m asked a ques.
I m using a Customized one that is bucketized .

AJ
0 Likes
Absent Member.
Absent Member.

OK!! Your problem is that you can't use the InActiveList in an active channel. What you want to do can't be done. Sorry for misunderstanding earlier but this is an arcsight issue that doesn't let you use any active lists included as conditions in an active channel.

0 Likes
Vice Admiral
Vice Admiral

Actually, if your active list has key fields, you can use a getActiveList function (variable) to replace the inActiveList condition (getMyAcitveList.key1 IS NOT NULL), and then  your active channel drill-down will work.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.