Creating a custom drilldown

A drilldown is a query built using values from a previous query. The module ConvertToDrilldownSearch will build a query automatically from the table or graph that it is nested inside. Unfortunately, this only works well when the query is fairly simple, and when you want to see raw events. To build a custom drilldown, we combine intentions and the nested nature of modules.

Building a drilldown to a custom query

Looking back at our chart in the Reusing a query section, let's build a custom drilldown that shows the top instances of another field when it is clicked on.

Here is an example dashboard that draws a chart and then runs a custom query when clicked on:

<view template="dashboard.html">
  <label>Chapter 8 - Drilldown to custom query</label>
  <!-- chrome -->
  <module
      name="HiddenSearch"
      layoutPanel="panel_row1_col1"
      autoRun="True"
      group="Errors by user">
    <param name="search">
      sourcetype="impl_splunk_gen...