How to put `| search splunk_web_service="574.357430"` before `| rex` command in drilldown table?
I mean, after click on value in drilldown table I want search like:
index=test sourcetype="test" splunk_web_service="574.357430" | rex ....
If you're using the advanced XML, (and I gather from the nature of your quesstion that you're using the 'addterm' intention), then you can add an 'indexed' flag to the intention
Intention syntax is ugly, but here's an addterm intention that adds myField="myValue", and note the last line -- that directive tells the intention system not to try and be clever, but to put the given term in the first search clause always.
<param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="myField">myValue</param> </param> <param name="flags"><list>indexed</list></param> </param>