It will depending upon how you want to drilldown. For example (taking the query you gave as sample), the drilldown could be just to run another query based on col2. If that's the case, try something like this (run anywhere sample). In below example, all users would be able to see is sourcetype=ClickedValue
**All dashboard are created under "Search & Reporting" app.
Dashboard Name :thefirstdashboard
<dashboard>
<label>thefirstdashboard</label>
<row>
<panel>
<table>
<search>
<query>index=_internal | stats count by sourcetype</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="count">10</option>
<drilldown><link>/app/search/seconddashboard?sourcetype=$row.sourcetype$</link></drilldown>
</table>
</panel>
</row>
</dashboard>
Dashboard Name:seconddashboard
<dashboard>
<label>seconddashboard</label>
<row>
<panel>
<chart>
<search>
<query>index=_internal sourcetype=$sourcetype$| timechart count</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">column</option>
</chart>
</panel>
</row>
</dashboard>
... View more
