Splunk Search

How can I use dynamic drilldown to go to external link/rdp session and fill field from the value clicked?

hubbardw
New Member

I'm trying to use dynamic drilldown to do the following:

  1. Open an external URL after a user clicks on a specific field.
  2. Take the value from the field that was clicked and fill it in the prompt given after the URL is reached.

Essentially the URL opens a link to a non-local RDP session(mstsc) where I was hoping to fill the RDP field with the value clicked by the user. This is not a local RDP session, it's a link to a jump server farm so it has to go through the URL in order to get to the remote RDP session.

Here's what I have so far -

<dashboard>
  <label>Windows User Login Auditing</label>
  <row>
    <panel>
      <table>
        <title>Windows User Logins</title>
        <search>
          <query>index="wineventlog" source="WinEventLog:Security" (EventCode=4624 OR 4634) Process_Name="*winlogon*"
| table user, dst_nt_domain, ComputerName, src_ip
| rename user as "User",  dst_nt_domain as "Domain", ComputerName as "Source FQDN", src_ip as "Source IP"
          </query>
          <earliest>-8h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>10m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="FQDN">
          <colorPalette type="map"></colorPalette>
        </format>
        <drilldown>
           <link>
                 https://URL.com/rdp/CmsRdsh.rdp?ReturnUrl=%2fRDWeb%2fPages%2fen-US%2fDefault.aspx?q=$click.value2$
           </link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...