It will depending upon how you want to drilldown. For example (taking the query you gave as sample), the drilldown could be just to run another query based on col2. If that's the case, try something like this (run anywhere sample). In below example, all users would be able to see is sourcetype=ClickedValue
**All dashboard are created under "Search & Reporting" app.
Dashboard Name :thefirstdashboard
<dashboard>
<label>thefirstdashboard</label>
<row>
<panel>
<table>
<search>
<query>index=_internal | stats count by sourcetype</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="count">10</option>
<drilldown><link>/app/search/seconddashboard?sourcetype=$row.sourcetype$</link></drilldown>
</table>
</panel>
</row>
</dashboard>
Dashboard Name:seconddashboard
<dashboard>
<label>seconddashboard</label>
<row>
<panel>
<chart>
<search>
<query>index=_internal sourcetype=$sourcetype$| timechart count</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">column</option>
</chart>
</panel>
</row>
</dashboard>
Could you explain more about your issue? Do you want to remove/hide the search string which is show in URL after drilldown? Providing your dashboard xml will help too.
I have created dashboards for users using splunk "dbquery" SPL command.
Ex: |dbquery "dbname" "select * from table1 where col1='xyz'" |stats count by col2
When User drills down , then i do not want him to view my query "select * from table1 where col1='xyz'".
Would like to understand how to hide the query from users view but allow him to drill down to see further results.