This is another question from http://splunk-base.splunk.com/answers/62535/possibility-of-adding-mutiple-url-to-a-redirector-and-selecting-different-cells-in-a-table.
I'm able to get a field other than the first cell of the row to be redirected to the appropriate url (view). But now I'm stuck trying to figure out how and where to place the if function in eval. Here is what I have as my redirector so far:
<module name="Redirector"> <param name="arg.sourceIpAddress">$click.fields.source_address$</param> <param name="arg.destinationIpAddress">$click.fields.destination_address$</param> <param name="arg.severity">$click.fields.severity$</param> <param name="arg.dstport">$click.fields.destination_port$</param> <param name="arg.autoRun">True</param> <param name="arg.srcport">$click.fields.source_port$</param> <param name="arg.user">$user.rawValue$</param> <param name="arg.earliest">$search.timeRange.earliest$</param> <param name="arg.latest">$search.timeRange.latest$</param> <param name="url">port_investigation_drilldown</param> </module>
Where would I put the eval if command? (I'm guessing after url) How would the command string go? Would it be like this: eval port_investigation_drilldown=if($click.fields.source_port$), if($click.fields.destination_port$) | eval ip_investigation_drilldown_Source=if($click.fields.source_address$) and so on.