Late to this discussion, but posting the answer here for any folks who search this up later. After some testing, I found that the Sankey drilldown tokens use the $row.Field Name$ format: <viz type="sankey_diagram_app.sankey_diagram"> <search> <query>... | stats sum(bytes) as total_bytes count by source target</query> </search> <option name="drilldown">all</option> <drilldown> <set token="form.source_tok">$row.source$</set> <set token="form.target_tok">$row.target$</set> </drilldown> </viz>   I don't believe there's a way to distinguish between a click on the source versus the target, so field conditions don't seem to work like they would for a table. ... View more