Disclaimer: Very new to Splunk. Can I pass multiple values defined in a fieldset tag using drilldown and simple XML, or do I need to learn advanced xml for this functionality? Every attempt I've made to pass a second value in a drilldown link (eg ../?form.token1=$value1$&form.token2=$value2$) just passes it through as written instead of the value it represents. I have a workflow where a user is identified (by name or ip address) in order to locate the identifier of the transaction, which is used to locate all events related with that user's actions within the system (not all of which include their user name in the event). However, the data is coming from multiple servers, and the identifiers periodically roll over so I'd like to be able to pass host and time information along with transaction id. Thanks! ... View more