How to pivot from tstats data to a regular search?

[redhonda03_2]

I don't know what the best way to word the subject, so if anyone has a better recommendation after reading my question below let me know what would be a better way to word the subject.

I have access to several different security dashboards from the InfoSec app. I am trying to figure out how to pivot from the summarized data shown in the dashboard which uses tstats to the traditional Search & Reporting app where I can view events and click on items of interest to narrow down the search.

One example is seeing an alert on a dashboard and when I open the search tstats only shows the source IP addresses. I'd like to see more information, such as a destination and other fields but tstats isn't designed to show information when you click on "events". This why I'd like to take the information from tstats and open up the Search and Reporting app so  I can scroll through the list of fields on the left and use that to help refine results.

[PickleRick]

There is no built-in way to do that. And there cannot be. The tstats command doesn't operate on events. It queries the indexed fields and datamodels so it only deals with selected subsets of data. In order to be able to launch a search with a selected field's value you'd probably need to define such behaviour in your visualization table on your own.