I have a single value panel that shows me the number of events by user. I want to create a drilldown when I click on the single value that displays a new panel in table format and lists the users and other details. I created a token, but I can't seem to get it to pull any user information.
<panel>
<title>Users Deleted (last 30 days)</title>
<single>
<search>
<query>index=windows sourcetype="wineventlog" source="wineventlog:security" EventCode="4726" NOT User="*$" | stats dc(user) AS "User Events"</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<option name="drilldown">all</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="USER">$row.user$</set>
</drilldown>
</single>
</panel>
</row>
<row>
<panel depends="$USER$">
<title>User Details</title>
<table>
<search>
<query>index=windows sourcetype="wineventlog" source="wineventlog:security" user="$USER$" | table user</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</dashboard>
... View more