According to the documentation, following options in single forms are now deprecated and shall not be used anymore: (while this still works, support may be removed in the future, and this is a failure for app certification check)
Ok, I guess this is related with Splunk 6.3.x single value improvements (cool!) that provides native options such as open in search, like in charts. (this was not the case febore)
But the story does not tell how the drilldown can be controlled now... the only drilldown related and non deprecated option is the drilldown activation:
drilldown (all | none) none all:
Drilldown enabled. none: Drilldown
disabled. This option applies to the
element to implement
dynamic drilldown for single values.
Do not enable this option if you are
implementing drilldown using the
following options to the
linkFields linkSearch linkView
Which will only activate the drilldown of the single value visualization, clicking on it will open in search the associated search.
Is there a way "non deprecated" to control the drilldown feature? (What search will be run, where, token re-used...)
Isn't it a loss of functionality ! Not an improvement... why putting these options deprecated without providing options with at least the same level of functionality?
A simple example to illustrate, let's say you have a single value associated with a search that will repors the number of relevant errors for your context, you want to provide to the user the drilldown feature a search that will show these errors... not how to count it which has no interest for the user... of course the user can modify the search itself, but this is not the idea behind user interface...