Actually yeah. Good point 🙂 But I have already done that with dynamic drilldown. Thanks anyway. I will provide my example for another users: <panel> <table> <title>Logins by country</title> <searchString> index = my_index | iplocation ipaddr | stats count by Country | sort count desc </searchString> ... <drilldown> <link> <![CDATA[ /app/my_splunk_app/search?q=search%20index%20%3D%20my_index ... %20%7C%20search%20Country%20%3D%20"$row.Country$" ... ]]> </link> </drilldown> ... ... View more

I am using 6.3. But docs are identical for both versions: http://docs.splunk.com/Documentation/Splunk/6.3.0/AdvancedDev/SetupExampleCustom Weird that it does not work from doc 😞 And error is: 2015-10-15 12:15:31,508 DEBUG [561f6eb2f1107002f90] _cplogging:55 - [15/Oct/2015:12:15:31] HTTP Traceback (most recent call last): File "/Applications/Splunk/lib/python2.7/site-packages/cherrypy/_cprequest.py", line 606, in respond cherrypy.response.body = self.handler() File "/Applications/Splunk/lib/python2.7/site-packages/cherrypy/_cpdispatch.py", line 25, in __call__ return self.callable(*self.args, **self.kwargs) File "/Applications/Splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/routes.py", line 366, in default return route.target(self, **kw) File "<string>", line 1, in <lambda> File "/Applications/Splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 38, in rundecs return fn(*a, **kw) File "<string>", line 1, in <lambda> File "/Applications/Splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 118, in check return fn(self, *a, **kw) File "<string>", line 1, in <lambda> File "/Applications/Splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 167, in validate_ip return fn(self, *a, **kw) File "<string>", line 1, in <lambda> File "/Applications/Splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 335, in preform_sso_check return fn(self, *a, **kw) File "<string>", line 1, in <lambda> File "/Applications/Splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 387, in check_login return fn(self, *a, **kw) File "<string>", line 1, in <lambda> File "/Applications/Splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 407, in handle_exceptions return fn(self, *a, **kw) File "<string>", line 1, in <lambda> File "/Applications/Splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 462, in apply_cache_headers response = fn(self, *a, **kw) File "/Applications/Splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 1567, in listEntities self.flattenElements(uiHelper['elements'], uiHelper_elements) KeyError: 'elements' ... View more