Splunk ITSI

How to add a hyperlink to Episode Review in Splunk ITSI 4.4.1?

patrickneuhaus
Engager

I have information in the episodes shown in the ITSI Episode Review in the form of URLs that reference other systems or the like.
I would like to display the information in these fields as clickable links so that users can open documentation on the error in another browser tab, or jump to the source systems using a remote operations tool, for example.

How can hyperlinks be displayed in ITSI (in addition to the drill-down link) that can be defined in the correlation search?

The configurable drill-down link in the correlation search is already in use for some other hyperlinks.
Is there a way to display additional fields as hyperlinks?

Alternatively, we are thinking about implementing a custom episode action that could enable these hyperlinks.
Does anyone have any experience or examples?

We are using Splunk ITSI Version 4.4.1.

Labels (3)

esnyder_splunk
Splunk Employee
Splunk Employee

Hi Patrick, I would suggest upgrading to version 4.5.0 if you can. Version 4.5.0 includes an Episode Instructions box in each aggregation policy where you can add custom instructions and other information to be displayed in episodes grouped by that policy. The instructions support Markdown so you can add clickable links.

Screen Shot 2020-07-25 at 9.27.14 PM.png

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...