How do I get a single value drilldown to a table?

[MarcoG17]

I have a single value panel that shows me the number of events by user. I want to create a drilldown when I click on the single value that displays a new panel in table format and lists the users and other details. I created a token, but I can't seem to get it to pull any user information.

    <panel>
      <title>Users Deleted (last 30 days)</title>
      <single>
        <search>
          <query>index=windows sourcetype="wineventlog" source="wineventlog:security" EventCode="4726" NOT User="*$" | stats dc(user) AS "User Events"</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="USER">$row.user$</set>
        </drilldown>
      </single>
    </panel>
  </row>
  <row>
    <panel depends="$USER$">
      <title>User Details</title>
      <table>
        <search>
          <query>index=windows sourcetype="wineventlog" source="wineventlog:security" user="$USER$" | table user</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</dashboard>

[Vijeta]

@MarcoG17- Your first query should be

stats dc(user) AS "User Events" by User| fields "User Events" , User

[MarcoG17]

this displays the users instead of the number in the single value panel. Not working as i would imagine.

[renjith_nair]

@MarcoG17

Your field name in search is User Events and you are trying to set the token to user
i.e. stats dc(user) AS "User Events" vs $row.user$

Try changing the search to

stats dc(user) AS user

[MarcoG17]

makes sense i did what you said but when i click on the single value number it still doesn't show the user name in the table.

[renjith_nair]

@MarcoG17,
Click on the search icon under the table panel and see what search it has executed. This would help us to find what value is passed and why no result is retrieved for that user.