Here the problem is when i click on the table's row/any of the value its not drilling down to a default flashtimeline but shows same tabular structure. Now in this tabular structure if i click agian then it will show the table but containing only clicked(the value which clicked) value.Here i wanted to show the default flashtimeline for the clicked values.
So pls help with the advance xml for this.
I think the problem isn't so much with the advanced XML as with the search.
Instead of the eventstats command I think you want to be using the stats command. Eventstats is an advanced command designed for more complex use cases and here it's just going to give you a lot of strange duplicates in your final results.
This search on the other hand:
host="sharepoint" | rex field=msg "\sMore\sinformation:\s(?<ErrorIdentifierField>[\dxA-F]+)" | stats count by ErrorIdentifierField | sort - count
will only have one row per ErrorIdentifierField, and as a bonus, when you click a row the generic drilldown will work as you expect. I think it's the eventstats that is making the drilldown logic behave oddly.
I also recommend setting the drilldown param to just "row".