Hi Nick. Thanks for the response. When you suggested that the search might be written differently, I re-wrote a part of it. The "timechart" section was using individually written terms to make the columns show-up. Now, instead, I reference a field defined in the body of the search "| eval columnName=substr(sourcetype, 0, len(sourcetype)-9)" so the "timechart" term looks like this: "| timechart span=1h partial=false count by columnName". With that change, the "built-in" drill-down on the legend started working. I suspect that if I use the "click.name2" now, I'll be able to do something more interesting with the drill-down. Also, asked my Splunk Admin to install your Sideview extension / add-on for Splunk. Once that happens, I'll give it a try. Thanks for making that contribution to the Splunk community - one of the architects at Splunk spoke very highly of it. ... View more