By default, Splunk visualizations have drilldown enabled. When a user clicks on a specific segment of a chart (such as a bar, a column, or a pie slice), Splunk initiates a new search. This new search automatically includes the field and value represented by the clicked segment as part of the search criteria. For example, clicking on a slice representing status=404 in a pie chart will run a new search that filters for events where the status field has a value of 404, effectively refining the search results to that specific data point.

A. drills down for that value This statement is too general. While clicking the segment does initiate a "drilldown," option C provides a more precise and descriptive explanation of the default action that occurs.
B. highlights the field value across the chart This is incorrect. The default action is not to highlight the value within the current visualization but to navigate to the search page and execute a new, more specific search.

1. Splunk Enterprise Documentation

Dashboards and Visualizations manual: In the section "Use drilldown for dashboard interactivity

" it states

"By default

clicking on a chart or other visualization in a dashboard takes you to the Search page. The search uses the time range of the dashboard panel and includes the values that you clicked on." It provides an example: "you click on the part of a pie chart that represents a 404 error. The search opens... and the search string is ... errorcode=404." This directly supports that the value is added to the search criteria.

2. Splunk Enterprise Documentation

Search Tutorial: In the "Refine your search" section

step 6 ("Use the chart to refine your search")

the tutorial guides the user: "In the sourcetype chart

click the accesscombinedwcookie bar. The chart drill-down action runs a new search that includes sourcetype="accesscombinedwcookie"." This demonstrates the action of adding the clicked value to the search.