Figured out the solution: 1. I just use $name$ to get the click event object line name. 2. Put latest="+1" 3. Removed all defined tokens and put the actual values into the search.   "eventHandlers": [ { "type": "drilldown.linkToSearch", "options": { "enableSmartSources": true, "query": "... where match(Object,\"$name$\") and match(Object_Time,\"$value$\")\r\n| ...", "earliest": "$row._time.value$", "latest": "+1m", "type": "custom", "newTab": true } } ] The ... View more

The emulation works wonderfully when doing it my test environment, however when doing the emulation in the search head, the "INTERESTING FIELDS" field names and their values are overriding the extracted values: host Component Value _time   F_Type_1 F_Type_1_Section_5_Value 2024-02-14 21:28:25   F_Type_1 F_Type_1_Section_5_Value 2024-02-14 21:28:25   F_Type_1 F_Type_1_Section_5_Value 2024-02-14 21:28:25   So I had to remove the auto-extracted field at the beginning Here is the final emulation in live data: | fields - Section_5 | dedup host | eval data = split(_raw, " ") | eval data = mvfilter(match(data, "^Component=")) | mvexpand data | rename data AS _raw | extract pairdelim=",", kvdelim="=" | rename Section_5 AS Value | table host Component Value _time   Thank you so much for your help!   ... View more