(TTP 59893) 4.5 sp1 Query Viewer - normal investigation menu option missing
You should be able to drill down into an active channel from a query viewer and get the normal "create channel..." or "add condition..." menu items, but it has to be done from an event-based field. The QV UI is more sensitive to where you initiate the right click investigate from. If you do it from the row AND column of the event-based field, you should get the drilldown to an AC. Otherwise, IIRC, you won't.
Let me know if this solves your issue.
Field based Active Lists are very flexible in that you name / populate the fields totally as you wish. However, there is no in-built mechanism to drill down to an event-based active channel, because there is no way to specify that an AL field named "External Intruder Addresses" is supposed to map to "sourceAddress". So the QV isn't able to specify a drilldown to an AC. This is something we might be able to add in a later release. If you *happen* to name a field in the QV / AL with a name that corresponds to an event field name, it would probably allow you to do the additional investigation options.
For now, you could construct an event-based QV with the event-based query you want, and then you should be able to drilldown / map from the parent AL-based QV to the event-based QV. And then, once you get to the event-based QV drilldown, you could actually go from there to a channel. Going through an event-based QV might also let you do other interesting things like baselines, aggregation, charts, etc.