For a single in-page drilldown, the following codes work as expected from "master1" table. How can I set up an in-page drilldown from either either token from "master1" or "master2"? <form> <label>Process Tracking</label> <fieldset submitButton="false"> <input type="dropdown" token="p_usage" searchWhenChanged="true"> <label>Usage</label> <search> <query>| inputlookup usage.csv</query> <earliest>0</earliest> </search> <fieldForLabel>range</fieldForLabel> <fieldForValue>range</fieldForValue> <initialValue>usage<1%</initialValue> <default>usage<1%</default> </input> <input type="time" token="p_time" searchWhenChanged="true"> <label>Time Range</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table id="master1"> <title>Total process</title> <search> <query>index=xxxxxx sourcetype="xxxxxxxx" range="$p_usage$" | stats dc(host) AS count by process | sort - count</query> <earliest>$p_time.earliest$</earliest> <latest>$p_time.latest$</latest> </search> <option name="drilldown">row</option> <drilldown> <set token="tk_process">$row.process$</set> </drilldown> </table> </panel> <panel> <table id="master2"> <title>Total Workstation</title> <search> <query>index=xxxxxx sourcetype="xxxxxxxx" range="$p_usage$" | stats dc(process) AS count by host | sort - count</query> <earliest>$p_time.earliest$</earliest> <latest>$p_time.latest$</latest> </search> <option name="drilldown">row</option> <drilldown> <set token="tk_host">$row.host$</set> </drilldown> </table> </panel> </row> <row> <table id="detail" depends="$tk_process$"> <title>Detail: $tk_process$</title> <search> <query>index=xxxxxx sourcetype="xxxxxxxx" process="$tk_process$" | dedup host process | table host process</query> <earliest>$p_time.earliest$</earliest> <latest>$p_time.latest$</latest> </search> </table> </row> </form> ... View more

I have a statistic table showed below. vendor low medium high ---------- ----- ------------ ------- V1 1 2 3 V2 2 4 5 Total 3 6 8 I set up a custom drill-down, for instance, for the vendor column, how can I set up a condition when clicked "Total" and it passes "*" to the custom drill-down? Thanks. <drilldown> <link field="vendor"> /app/my_app/details?form.vendor=$row.vendor$ </link> </drilldown> ... View more

Hi. Does anyone know what "Time" is referring to from "Incident Review" from Splunk Enterprise Security (see image below)? As seen from picture, there are more 1 incident triggered in "9/23/16 9:55:08.000 PM". Is this timestamp when the use case was triggered? Where is this timestamp stored from the backend objects such as kvstores? Incident Review ... View more