Splunk Search

How can I use dynamic drilldown to go to external link/rdp session and fill field from the value clicked?

hubbardw
New Member

I'm trying to use dynamic drilldown to do the following:

  1. Open an external URL after a user clicks on a specific field.
  2. Take the value from the field that was clicked and fill it in the prompt given after the URL is reached.

Essentially the URL opens a link to a non-local RDP session(mstsc) where I was hoping to fill the RDP field with the value clicked by the user. This is not a local RDP session, it's a link to a jump server farm so it has to go through the URL in order to get to the remote RDP session.

Here's what I have so far -

<dashboard>
  <label>Windows User Login Auditing</label>
  <row>
    <panel>
      <table>
        <title>Windows User Logins</title>
        <search>
          <query>index="wineventlog" source="WinEventLog:Security" (EventCode=4624 OR 4634) Process_Name="*winlogon*"
| table user, dst_nt_domain, ComputerName, src_ip
| rename user as "User",  dst_nt_domain as "Domain", ComputerName as "Source FQDN", src_ip as "Source IP"
          </query>
          <earliest>-8h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>10m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="FQDN">
          <colorPalette type="map"></colorPalette>
        </format>
        <drilldown>
           <link>
                 https://URL.com/rdp/CmsRdsh.rdp?ReturnUrl=%2fRDWeb%2fPages%2fen-US%2fDefault.aspx?q=$click.value2$
           </link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...