Run the dashboard. Click "Edit". Scroll to your panel. In the upper-right corner, click on the snowman menu and select "Edit Drilldown". In the popup that opens, select "Link to Search". In the redrawn popup, select, "Custom". Paste this in it: index="keycloak" AND fields.environment="production" AND customerReferenceAccountId="$click.value$" AND type="UPDATE_PASSWORD" | table AccountID, username, userId, redirect_uri, ipAddress, _time Or maybe something like this: |inputlookup foo WHERE AccountID="$click.value$" Save it all.
... View more