Hi @siddharthad, in the drilldown link, you have to pass all the fields (in the ones that you have in your results) that are useful to identify the events to display in the drilldown dashboard. Put attention that you can pass only the fields in your main search, e.g. if you have a | table _tima, Name host, the only fields that you can pass are _time, Name and host. If you need to pass other fields that you don't want to display in the main dashboard, you can add them to the search and list the fields to display in the <fields></fields> tag. Ciao. Giuseppe ... View more