work in progress for idaholab#331, add transform vis. to Files dashbo…

…ard for file downloads
mmguero-dev · Apr 2, 2024 · e77885f · e77885f
1 parent c58ccef
commit e77885f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/dashboards/dashboards/9ee51f94-3316-4fc5-bd89-93a52af69714.json b/dashboards/dashboards/9ee51f94-3316-4fc5-bd89-93a52af69714.json
@@ -353,7 +353,7 @@
       "version": "WzEyODAsMV0=",
       "attributes": {
         "title": "Extracted File Downloads",
-        "visState": "{\"title\":\"Extracted File Downloads\",\"type\":\"transform\",\"aggs\":[],\"params\":{\"meta\":\"({})\",\"multiquerydsl\":\"{\\n  \\\"topn\\\": {\\n    \\\"index\\\": \\\"MALCOLM_NETWORK_INDEX_PATTERN_REPLACER\\\",\\n    \\\"query\\\": {\\n      \\\"bool\\\": {\\n        \\\"must\\\": [\\n          \\\"_DASHBOARD_CONTEXT_\\\",\\n          \\\"_TIME_RANGE_[firstPacket]\\\",\\n          {\\n            \\\"match\\\": {\\n              \\\"event.dataset\\\": \\\"files\\\"\\n            }\\n          },\\n          {\\n            \\\"match\\\": {\\n              \\\"event.provider\\\": \\\"zeek\\\"\\n            }\\n          }\\n        ]\\n      }\\n    },\\n    \\\"aggs\\\": {\\n      \\\"uris\\\": {\\n        \\\"terms\\\": {\\n          \\\"field\\\": \\\"zeek.files.extracted_uri\\\",\\n          \\\"size\\\": 10,\\n          \\\"order\\\": { \\\"_key\\\": \\\"asc\\\" }\\n        }\\n      }\\n    }\\n  }\\n}\",\"formula\":\"<link rel=\\\"stylesheet\\\" href=\\\"/css/styles.css\\\">\\n\\n<h2><a href=\\\"/readme/docs/file-scanning.html#ZeekFileExtraction\\\">Extracted File</a> Downloads</h2>\\n<p><small>Only the first 10 matching results are displayed, sorted alphabetically. Apply filters ⊕ to narrow scope.</small></p>\\n<table class=\\\"table caption-top\\\">\\n  <thead>\\n    <tr>\\n      <th scope=\\\"col\\\">Download Link (if preserved)</th>\\n    </tr>\\n  </thead>\\n  <tbody>\\n    {{#response.topn.aggregations.uris.buckets}} \\n    <tr>\\n      <th scope=\\\"row\\\"><a href=\\\"/{{key}}\\\">💾 {{key}}</a></th>\\n    </tr>\\n    {{/response.topn.aggregations.uris.buckets}} \\n    </tbody>\\n</table>\\n<p><small><a href=\\\"/extracted-files/\\\">You can also <strong>📁 Browse extracted files</strong></a>. See <em><a href=\\\"/readme/docs/file-scanning.html#ZeekFileExtraction\\\">Automatic file extraction and scanning</a></em> for more information.</small></p>\"}}",
+        "visState": "{\"title\":\"Extracted File Downloads\",\"type\":\"transform\",\"aggs\":[],\"params\":{\"meta\":\"({})\",\"multiquerydsl\":\"{\\n  \\\"topn\\\": {\\n    \\\"index\\\": \\\"MALCOLM_NETWORK_INDEX_PATTERN_REPLACER\\\",\\n    \\\"query\\\": {\\n      \\\"bool\\\": {\\n        \\\"must\\\": [\\n          \\\"_DASHBOARD_CONTEXT_\\\",\\n          \\\"_TIME_RANGE_[firstPacket]\\\",\\n          {\\n            \\\"match\\\": {\\n              \\\"event.dataset\\\": \\\"files\\\"\\n            }\\n          },\\n          {\\n            \\\"match\\\": {\\n              \\\"event.provider\\\": \\\"zeek\\\"\\n            }\\n          }\\n        ]\\n      }\\n    },\\n    \\\"aggs\\\": {\\n      \\\"uris\\\": {\\n        \\\"terms\\\": {\\n          \\\"field\\\": \\\"zeek.files.extracted_uri\\\",\\n          \\\"size\\\": 10,\\n          \\\"order\\\": { \\\"_key\\\": \\\"asc\\\" }\\n        }\\n      }\\n    }\\n  }\\n}\",\"formula\":\"<link rel=\\\"stylesheet\\\" href=\\\"/css/styles.css\\\">\\n\\n<h2><a href=\\\"/readme/docs/file-scanning.html#ZeekFileExtraction\\\" target=\\\"_blank\\\">Extracted File</a> Downloads</h2>\\n<p><small>Only the first 10 matching results are displayed, sorted alphabetically. Apply filters ⊕ to narrow scope.</small></p>\\n<table class=\\\"table caption-top\\\">\\n  <thead>\\n    <tr>\\n      <th scope=\\\"col\\\">Download Link (if preserved)</th>\\n    </tr>\\n  </thead>\\n  <tbody>\\n    {{#response.topn.aggregations.uris.buckets}} \\n    <tr>\\n      <th scope=\\\"row\\\"><a href=\\\"/{{key}}\\\" target=\\\"_blank\\\">💾 {{key}}</a></th>\\n    </tr>\\n    {{/response.topn.aggregations.uris.buckets}} \\n    </tbody>\\n</table>\\n<p><small>You can also <a href=\\\"/extracted-files/\\\" target=\\\"_blank\\\">📁<strong>Browse extracted files</strong></a>. See <em><a href=\\\"/readme/docs/file-scanning.html#ZeekFileExtraction\\\" target=\\\"_blank\\\">Automatic file extraction and scanning</a></em> for more information.</small></p>\"}}",
         "uiStateJSON": "{}",
         "description": "",
         "version": 1,