editing custom drilldown in splunk web

[jcorkey]

How can I have a different drilldown search string for each item that gets listed by the stats command? Seems like when I'm on my dashboard and select edit panels> more actions> edit drilldown, I can only set one search string the gets called when I click any item listed by the stats command.

Here is my main search I am doing:

| multisearch [search index=* host=* sourcetype="*" user="*" "type=ADD_USER" | eval rectype1="Created new user"] [search index=* host=* sourcetype="*" "usermod" AND "type=USER_MGMT" | eval rectype2="Added new user to group"] [search host="*" index="secure_logs" sourcetype=linux_secure  "su:" "session opened for user" | eval Date=strftime(_time, "%Y/%m/%d") | rex "by (?<user>[^(]+)" | rex "^[^\)\n]*\):\s+\w+\s+\w+\s+\w+\s+\w+\s+(?P<switchedToThisUser>\w+)" | eval rectype3= "Switched to different user account"] | stats dc(rectype3) as "Switched to different user account" , dc(rectype2) as "Added new user to group", dc(rectype1) as "Created new user" by user

I want to have a different search string for when either rectype3, rectype2, or rectype1 are clicked on but right now I can only have one for all of them. How can I accomplish this?

[niketn]

You can add <condition> for clicked field names and then set your corresponding Search String as token.

    <drilldown>
      <condition field="Switched to different user account">
        <set token="queryString">$row.Switched to different user account$</set>
      </condition>
      <condition field="Added new user to group">
        <set token="queryString">$row.Added new user to group$</set>
      </condition>
      <condition field="Created new user">
        <set token="queryString">$row.Created new user$</set>
      </condition>
      <condition>
        <!-- Optional No Drilldown from other columns-->
      </condition>          
    </drilldown>

For simplicity's sake I have added the clicked Column's value as the token, you can set your own. Also Drilldown has been disabled for columns other than the three mentioned in the question by using empty condition block.
Refer to the Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#set