drilldown does not work with "search base=" and query

[luigialbino]

I have a dashboard with many panel that use the same global search "my search_1", and each panel have an own query like " timechart count(field).." or "table field1".
When I click on a value on the chart, the drilldown give me all the output of global query "my_search1" missing the other part of query "timechart......" or "table fied1"
I look on the drilldown documentation but I don't found anything about the "search base=" o something like that.
Can anyone help me with this issue?

My_search1
.....

<query>

sourcetype="WinEventLog:Security" $field2$ EventCode="627" OR EventCode="628" OR EventCode="642" OR EventCode="644" OR EventCode="671" OR EventCode="685" OR EventCode="4723" OR EventCode="4724" OR EventCode="4738" OR EventCode="4740" OR EventCode="4767" OR EventCode="4781" OR EventCode="624" OR EventCode="626" OR EventCode="632" OR EventCode="636" OR EventCode="660" OR EventCode="4720" OR EventCode="4722 "OR EventCode="4728" OR EventCode="4732" OR EventCode="4756" OR EventCode="629" OR EventCode="630" OR EventCode="633" OR EventCode="634" OR EventCode="637" OR EventCode="638" OR EventCode="661" OR EventCode="662" OR EventCode="4725" OR EventCode="4726" OR EventCode="4729" OR EventCode="4730" OR EventCode="4733" OR EventCode="4734" OR EventCode="4757" OR EventCode="4758" OR EventCode="626" OR EventCode="4722" OR EventCode="629" OR EventCode="4725" OR EventCode="644" OR EventCode="4740" OR EventCode="671" OR EventCode="4767" $Business$| search NOT (Source_AccountName="*$" AND Target_AccountName="-")

..........

panel search
......

    <search base="my_search1">
      <query>|timechart  count(eval(EventCode="644" OR EventCode="4740")) AS acc_locked,count(eval(EventCode="671" OR EventCode="4767")) AS acc_unlocked</query>
    </search>

......

[woodcock · Accepted solution]

The best answer is to set your own manual drilldown and avoid the defaults. It is pretty easy. Download the V6 Visualizations app on splunkbase for many examples.