Use the default search

A secondary search generates automatically to show more information about the clicked value. This search is similar to the search driving the source visualization but generates results that are more specific to the clicked value.

Customize the search

You can customize the secondary search to generate different results. For example, you might want to show results for a separate data set or include different fields or commands in the search string.

You can use predefined tokens to include the clicked value in the search.

Example

This column chart shows event counts by sourcetype over the last week.

The chart is generated using the following search string.

index = _internal | stats count by sourcetype

Drilldown linking to a default search is enabled on the chart. If a user clicks the mongod sourcetype column in the chart, a secondary search opens. This search removes aggregations and generates an events list for the mongod sourcetype value.

Users can explore details for the mongod sourcetype that were not available in the column chart.

Drilldown defaults and customization

Some default drilldown settings are new in software version 6.6.0. Review drilldown defaults and customization in Use drilldown for dashboard interactivity.

Enable the drilldown

Find the <option name="drilldown">none</option> element in the visualization. Change the option to enable and focus the drilldown. For example, in a table visualization, use <option name="drilldown">cell</option> to enable drilldown on table cells.

Once enabled, the drilldown links to a default search in the same browser tab.

Search syntax

Default search

<option name="charting.drilldown">all</option>

Check the Simple XML Reference to review the <option> name and syntax to use for each visualization.

Custom search

This example uses the target attribute to open the search in a new browser tab. The drilldown links to the search page and uses the q parameter to pass in the custom search string.

<drilldown>
    <link target="_blank">search?q=index=_internal | stats count by sourcetype</link>
</drilldown>

Default search

This search generates a table aggregating customer actions on a retail website.

source="my_retail_data_source" | stats count by action

Drilldown linking to a default search is enabled in the table. The default search removes the aggregation by sourcetype and filters events for the selected sourcetype column. If a user clicks on the addtocart action, the following secondary search opens.

source="my_retail_data_source" action="addtocart"

The default search filters results for the selected action. You might want to show more specific details. To override this default behavior, create a custom secondary search in the drilldown editor or in Simple XML.

Customizing the search

Customize the drilldown search to show users more information about the products involved in customer actions. The following search string uses the $click.value2$ predefined token to capture the action that users click and filter product counts for it.

source="my_retail_data_source" action=$click.value2$ | stats count by productId

Customizing the search in the drilldown editor

Customizing the search in Simple XML

<drilldown>
    <link target="_blank">search?q=source="my_retail_data_source" action=$click.value2$ | stats count by productId</link>
</drilldown>

The drilldown uses the $click.value2$ predefined token to capture the action that users click and use it in the search.

You can add custom time range parameters to the search. Use the <![CDATA[]]> wrapper or HTML character entities to escape the & ampersand or other special characters.

This example sets the time range for the last twenty-four hours.

<drilldown>
    <link target="_blank">
      <![CDATA[
        search?q=source="my_retail_data_source" action=$click.value2$ | stats count by productId&earliest=-24h@h&latest=now
         ]]>
    </link>
</drilldown>

For more syntax details, see the <link> element in the Simple XML Reference.