Does Splunk Drilldown actually work?

[yiguanghu]

I have a stats that shows count of several columns by _time. It shows the timeline and table correctly. But when I clicked the green bar to drill down, It always show 0 results. Please let me know what am I missing?

[yiguanghu]

Looks like drilldown works ok on single source searches. My situation is the search contains two sources joined together throgh different columns using eval and sub search as following:

source="sample1.csv"| eval joinid=if(isnotnull(key), key, "Incident") | join joinid [search source="sample2.csv"| eval joinid=if(isnotnull(Key), Key, "Jira")] | bucket _time span=1h | stats count as incidents, count(Key) as jiras, count(Issue_Links) as clonedjira by _time

Anyway can drill down from on this search?