Splunk Search

Is there a way to create a hyperlink in a stats table to an external site?

Sarmbrister
Path Finder

I am currently working on a Splunk query to look at Windows Defender data that has been allowed in the environment. I am using an evalto combine two fields which creates the URL to the Windows Defender Security Intelligence page. What I'd like to do is to make that result in the field a hyper link so all I have to do is click it and it directs me to the Windows Defender Security site. In my results example below I'd like to make the results in field windeflink a hyperlink.

My Search Query:
index=sccm sourcetype="sccm:malware" action=allowed
|stats count by dest_name,severity,signature
|eval windeflinkpart="https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name="
|eval windeflink=(windeflinkpart. "" .signature)
|table dest_name,severity,signature,count,windeflink
|sort severity

Results Example:
dest_name severity signature count windeflink
Severe 8 https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=

Tags (3)
0 Karma
1 Solution

@Sarmbrister, you can try the following run anywhere search. You would not need URL column in the Table. You can code table drilldown to add the signature token to the Custom URL. You can replace with your search.

  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval dest_name= "severe"
| eval severity=8
| eval signature="Ransom:PowerShell/Abpodul.A"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition field="signature">
            <link target="_blank">https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=$row.signature$</link>
          </condition>
          <condition>
            <!-- DO NOTHING ON OTHER COLUMNS-->
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

woodcock
Esteemed Legend

@sideview (the author of WorkFlow Actions) were just discussing the need for WorkFlow Actions on the Statistics tab.

0 Karma

@Sarmbrister, you can try the following run anywhere search. You would not need URL column in the Table. You can code table drilldown to add the signature token to the Custom URL. You can replace with your search.

  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval dest_name= "severe"
| eval severity=8
| eval signature="Ransom:PowerShell/Abpodul.A"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition field="signature">
            <link target="_blank">https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=$row.signature$</link>
          </condition>
          <condition>
            <!-- DO NOTHING ON OTHER COLUMNS-->
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Sarmbrister
Path Finder

This is great! Thank you @niketnilay.

0 Karma

Glad it worked 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...