A drilldown is a query built using values from a previous query. The ConvertToDrilldownSearch
module will build a query automatically from the table or graph that it is nested inside. Unfortunately, this works well only when the query is fairly simple and when you want to see raw events. To build a custom drilldown, we will combine intentions and the nested nature of modules.
Looking back at our chart in the Reusing a query section, let's build a custom drilldown that shows the top instances of another field when it is clicked on.
Here is an example dashboard that draws a chart and then runs a custom query when clicked on:
<view template="dashboard.html"> <label>Chapter 9 - Drilldown to custom query</label> <!-- chrome --> <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True" group="Errors by user"> <param name="search"> sourcetype=* loglevel=error | top user <...