As an alternative to the JavaScript route, you could instead use the report search to set a field, then reuse that field in drilldown link:
With a multiselect producing a search string like (sourcetype=foo OR sourcetype=bar) :
<input type="multiselect" token="sourcetypes" depends="$dt.earliest$,$dt.latest$" searchWhenChanged="true">
<label>Source Type</label>
<choice value="*">Show All</choice>
<default>Show All</default>
<search>
<query>index=_internal | stats count by sourcetype</query>
<earliest>$dt.earliest$</earliest>
<latest>$dt.latest$</latest>
</search>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>sourcetype=</valuePrefix>
<delimiter> OR </delimiter>
</input>
Then using the above in the report search as a part of the search as well as setting a field _querystring changing (sourcetype=foo OR sourcetype=bar) into form.sourcetypes=foo&form.sourcetypes=bar .
index="_internal" | search $sourcetypes$ | eval _querystring=replace(replace(ltrim(rtrim("$sourcetypes$",")"),"("),"sourcetype=","form.sourcetypes=")," OR ","&") | stats count by sourcetype, _querystring
Worth pointing out that you have to make sure the field _querystring is in the results and then use dashboard visualisation to hide it.
Then this can be used in the drilldown link (using |n to make sure it doesn't get escaped):
<link>
<![CDATA[mutliselect-drilldown?form.dt.earliest=$earliest$&form.dt.latest=$latest$&$row._querystring|n$]]>
</link>
Working example:
<form>
<label>Multiselect Drilldown</label>
<fieldset submitButton="false">
<input type="time" token="dt" searchWhenChanged="true">
<label></label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
<input type="multiselect" token="sourcetypes" depends="$dt.earliest$,$dt.latest$" searchWhenChanged="true">
<label>Source Type</label>
<choice value="*">Show All</choice>
<default>Show All</default>
<search>
<query>index=_internal | stats count by sourcetype</query>
<earliest>$dt.earliest$</earliest>
<latest>$dt.latest$</latest>
</search>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>sourcetype=</valuePrefix>
<delimiter> OR </delimiter>
</input>
</fieldset>
<row>
<panel>
<title>Source Types</title>
<table>
<search>
<query>
<![CDATA[index="_internal" | search $sourcetypes$ | eval _querystring=replace(replace(ltrim(rtrim("$sourcetypes$",")"),"("),"sourcetype=","form.sourcetypes=")," OR ","&") | stats count by sourcetype, _querystring]]>
</query>
<earliest>$dt.earliest$</earliest>
<latest>$dt.latest$</latest>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="rowNumbers">false</option>
<option name="wrap">true</option>
<fields>["sourcetype","count"]</fields>
<drilldown>
<link>
<![CDATA[mutliselect-drilldown?form.dt.earliest=$earliest$&form.dt.latest=$latest$&$row._querystring|n$]]>
</link>
</drilldown>
</table>
</panel>
</row>
</form>
Check the working project out here: https://github.com/mcwarman/splunk-multiselect-drilldown/.
... View more