@matstap is the fieldA actually multivalue? or is it single value with multiple comma separated values? Both are two different things. Can you share the query which generates fieldA? Is it something like values(fieldA) as fieldA, (as that would be a multivalue field)?
Try the following run anywhere example which converts a multivalue field to comma separated values using nomv command and upon clicking opens a new search with OR for each value
The <eval> block in the drilldown converts comma separated values to OR separated values i.e. <eval token="tokFieldADrilldown">" ( ".replace($click.value2$,","," OR ")." ) "</eval>
<dashboard>
<label>Multivalue drilldown to search replace comma with OR</label>
<row>
<panel>
<title>$tokFieldADrilldown$</title>
<table>
<search>
<query>| makeresults
| eval fieldA="a,b,c;x,y,z;h,i,j,k"
| makemv fieldA delim=";"
| mvexpand fieldA
| makemv fieldA delim=","
| nomv fieldA</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<condition field="fieldA">
<eval token="tokFieldADrilldown">" ( ".replace($click.value2$,","," OR ")." ) "</eval>
<link target="_blank">search?q=| makeresults
| search $tokFieldADrilldown$&earliest=-24h@h&latest=now</link>
</condition>
</drilldown>
</table>
</panel>
</row>
</dashboard>
PS: If your fieldA is actually multivalue field you would need to pipe | nomv fieldA command to convert it to comma separate single value field. If fieldA is already a comma-separated single value field, then you would just need the <drilldown> section of the code to be applied to the fieldA in your existing dashboard.
Please try out and confirm!
... View more
