This is what the XML code looks like, it is currently displaying all the logs in the server when I click on a specific attribute instead of just that log is there a way to fix that. <form> <label>Genesys Search Test</label> <fieldset submitButton="false" autoRun="true"> <input type="text" token="tok_ID" searchWhenChanged="true"> <label>ConnID/CallUUID</label> <default>*</default> </input> </fieldset> <row> <panel> <title>Genesys Server</title> <table> <title>Avaya Tserver</title> <search> <query>index=windowsapps sourcetype=Genesys_AvayaTserver "$tok_ID$" | rex"(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?&lt;EventName&gt;\w+)"| rex"AttributeConnID'?\s'?(?&lt;AttributeConnID&gt;[^\t\n\r]+)"| rex"AttributeANI'?\s'?(?&lt;AttributeANI&gt;[^\t\n\r]+)"| rex"AttributeDNIS'?\s'?(?&lt;AttributeDNIS&gt;[^\t\n]+)"| rex"AttributeCallType'?\s'?(?&lt;AttributeCallType&gt;[^\t\n]+)"|rex"AttributeCallUUID'?\s'?(?&lt;AttributeCallUUID&gt;[^\t\n]+)"|rex"AttributeUserData'?\s'?(?&lt;AttributeUserData&gt;[^\t\n]+)"|table_time EventName AttributeConnID AttributeANI AttributeDNIS AttributeCallType AttributeCallUUID AttributeUserData| where isnotnull(AttributeANI)</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <drilldown> <condition> <set token="tok_ShowEvents">true</set> <eval token="e">$click.value$-1</eval > <eval token="l">$click.value$+1</eval > <set token="AttributeConnID">$row.AttributeConnID$</set> <set token="AttributeANI">$row.AttributeANI$</set> <set token="AttributeCallType">$row.AttributeCallType$</set> <set token="AttributeDNIS">$row.AttributeDNIS$</set> <set token="AttributeCallUUID">$row.AttributeCallUUID$</set> </condition> </drilldown> <option name="wrap">undefined</option> <option name="rowNumbers">undefined</option> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">bubble</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="count">10</option> </table> </panel> </row> <row> <panel depends="$tok_ShowEvents$"> <event> <search> <query>index=windowsapps sourcetype=Genesys_AvayaTserver earliest=$e$ latest=$l$ | rex "(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?&lt;EventName&gt;\w+)"| rex "AttributeConnID'?\s'?(?&lt;AttributeConnID&gt;[^\t\n\r]+)"| rex "AttributeANI'?\s'?(?&lt;AttributeANI&gt;[^\t\n\r]+)"| rex "AttributeDNIS'?\s'?(?&lt;AttributeDNIS&gt;[^\t\n]+)"| rex "AttributeCallType'?\s'?(?&lt;AttributeCallType&gt;[^\t\n]+)"| rex "AttributeCallUUID'?\s'?(?&lt;AttributeCallUUID&gt;[^\t\n]+)"| rex "AttributeUserData'?\s'?(?&lt;AttributeUserData&gt;[^\t\n]+)"</query> <earliest></earliest> <latest></latest> </search> </event> </panel> </row> </form> ... View more

You need to set tokens based on what the user has clicked. See here for docs, you will need something like this in your table where the user is supposed to click for drilldown: <table> <search>... </search <option ...> <drilldown> <set token="drilldown_attribute">$click.name2$</set> </drilldown> </table> In the table (or events panel or chart, it's the same for all visualizations) showing only messages from the given attribute, you need something like this: <table> <search> <query>source=foo attribute="$drilldown_attribute$" | table ... </query> </search <option ...> </table> Refer to the docs for more info on click.name2 and other options. ... View more

yes the prefix will always be the same. Here are a few examples: 08:27:48.526 Trc 01234 RequestDistributeEvent received from [xxx] 06:31:25.488 Trc 01234 RequestDistributeEvent received from [xxx] 09:06:51.846 Trc 01234 RequestDistributeEvent received from [xxx] 03:32:37.964 Trc 01234 RequestDistributeEvent received from [xxx] ... View more

Use this regex to extract the field. Create one for each field. ... | rex "ANI'?\s'?(?<AttributeANI>[^\t\n']+)" | table AttributeANI *OR, instead of table, you could do timechart * ... | rex "ANI'?\s'?(?<AttributeANI>[^\t\n']+)" | timechart values(Attribute*) as Attribute* ... View more