Is there a way to create a hyperlink in a stats table to an external site?

[Sarmbrister]

I am currently working on a Splunk query to look at Windows Defender data that has been allowed in the environment. I am using an evalto combine two fields which creates the URL to the Windows Defender Security Intelligence page. What I'd like to do is to make that result in the field a hyper link so all I have to do is click it and it directs me to the Windows Defender Security site. In my results example below I'd like to make the results in field windeflink a hyperlink.

My Search Query:
index=sccm sourcetype="sccm:malware" action=allowed
|stats count by dest_name,severity,signature
|eval windeflinkpart="https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name="
|eval windeflink=(windeflinkpart. "" .signature)
|table dest_name,severity,signature,count,windeflink
|sort severity

Results Example:
dest_name severity signature count windeflink
Severe 8 https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=

[woodcock]

@sideview (the author of WorkFlow Actions) were just discussing the need for WorkFlow Actions on the Statistics tab.

[niketn · Accepted solution]

@Sarmbrister, you can try the following run anywhere search. You would not need URL column in the Table. You can code table drilldown to add the signature token to the Custom URL. You can replace with your search.

  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval dest_name= "severe"
| eval severity=8
| eval signature="Ransom:PowerShell/Abpodul.A"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition field="signature">
            <link target="_blank">https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=$row.signature$</link>
          </condition>
          <condition>
            <!-- DO NOTHING ON OTHER COLUMNS-->
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>

[Sarmbrister]

This is great! Thank you @niketnilay.

[niketn]

Glad it worked 🙂