This is a note to future-me on how to do row based drill downs on tables in a Splunk dashboard.

Set a token

Set the drilldown to row on the source table and set a token based on one of the clicked values, e.g. in a <table>, you could do:

<option name="drilldown">row</option>
<drilldown>
    <set token="travel_type">$row.type$</set>
</drilldown>

The token can be used in further panels.

Setting the depends attribute of a panel downstream will hide it until the token has been populated

<chart depends="$travel_type$">

Open a link

Another type of drilldown is for a link (hint: link to a dashboard in your own instance with prepopulated tokens):

<option name="drilldown">row</option>
<drilldown>
    <link target="_blank">/app/transaction_app/merchant_query?form.merchant_name=$row.merchant$</link>
</drilldown>

When you link to your own splunk server, use the relative URL from /app. That way, you don’t need to worry about different user’s region settings or the server name changing.