so I created a field like so:
|eval message_id=AREA.SUBID
| stats count as "Number of message_id" by message_id
| sort 10 - "Number of message_id"
This gives me a column chart with the message_id on the X axis and count on Y axis. With the drilldown setting shown in the pictures below, i'm trying to make that the following query indicate details only for the specific message_id I am cliking on the column chart
|eval message_id=AREA.SUBID
| rename TEXT as Text, ICON as Priority, USER as User
| stats count by User, Text, Priority
|where message_id="$mess_id2$"
|sort - count
Yet I get the "no results found" message. I know this is related to the fact that the field is "artificial" but I can't find a way to fix it
You might want to try $click.name$ rather than $click.value$ in your drilldown token
Also, you might want to filter the search results earlier:
| where AREA.SUBID="$mess_id2$"
| rename TEXT as Text, ICON as Priority, USER as User
| stats count by User, Text, Priority
|sort - count
The where command returns no results because there is no message_id field in the data. The field was stripped out by the stats command. Perhaps moving where before stats will give you the results you seek.
You might want to try $click.name$ rather than $click.value$ in your drilldown token
Also, you might want to filter the search results earlier:
| where AREA.SUBID="$mess_id2$"
| rename TEXT as Text, ICON as Priority, USER as User
| stats count by User, Text, Priority
|sort - count