I have a series of panels in a dashboard that drill down to the next panel.  I discovered that the data I want to drilldown on the populates in different sections of the event.  I used the field extraction tool in splunk to create two fields.  I then used the eval and coalesce to create one field.   index=”someIndex” sourcetype="FooSource" | rename Field1 as Foo1 Field2 as Foo2 | eval TotalFoo = coalesce(foo1,foo2)  | chart dc(field3) by "TotalFoo" Field4 For the panel I want to populate based on the TotalFoo field won't work. I believe this is due to the sub-search runs before the main search, so the TotalFoo field does not exist.   index=”someIndex” sourcetype="FooSource" | rename Field1 as Foo1 Field2 as Foo2 | eval TotalFoo = coalesce(foo1,foo2) | search TotalFoo="$onClick$" I'm wondering how to get around this limitation or if that is possibel?   ... View more