Splunk Search

How can I use dynamic drilldown to go to external link/rdp session and fill field from the value clicked?

hubbardw
New Member

I'm trying to use dynamic drilldown to do the following:

  1. Open an external URL after a user clicks on a specific field.
  2. Take the value from the field that was clicked and fill it in the prompt given after the URL is reached.

Essentially the URL opens a link to a non-local RDP session(mstsc) where I was hoping to fill the RDP field with the value clicked by the user. This is not a local RDP session, it's a link to a jump server farm so it has to go through the URL in order to get to the remote RDP session.

Here's what I have so far -

<dashboard>
  <label>Windows User Login Auditing</label>
  <row>
    <panel>
      <table>
        <title>Windows User Logins</title>
        <search>
          <query>index="wineventlog" source="WinEventLog:Security" (EventCode=4624 OR 4634) Process_Name="*winlogon*"
| table user, dst_nt_domain, ComputerName, src_ip
| rename user as "User",  dst_nt_domain as "Domain", ComputerName as "Source FQDN", src_ip as "Source IP"
          </query>
          <earliest>-8h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>10m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="FQDN">
          <colorPalette type="map"></colorPalette>
        </format>
        <drilldown>
           <link>
                 https://URL.com/rdp/CmsRdsh.rdp?ReturnUrl=%2fRDWeb%2fPages%2fen-US%2fDefault.aspx?q=$click.value2$
           </link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...