FIrst, I would rewrite your search as
index=elf
| eval CountType = case(eventtype="3000","AUDIT",
eventtype="6000", "USAGE"
eventtype="7000", "HEART_BEAT",
eventtype="10000", "ERROR",
1=1,"Unknown" )
| where CountType!=unknown
| chart count by app_id CountType
It just seems easier. Second, drilldown may not work because of the way you have structured the result table. For example, Splunk isn't going to be able to connect "USAGE" with eventtype="6000". I think this will be true regardless of whether you use the original search or the search I've shown above. And I can't see how to do this even with a custom drilldown.
You could do this:
index=elf (eventtype="3000" OR eventtype="6000" OR eventtype="7000" OR eventtype="10000")
| chart count by app_id eventtype
Now your drilldown should work, but your headings won't be as nice.
... View more