<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic SavedSearch Post Process drilldown  help ?? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/SavedSearch-Post-Process-drilldown-help/m-p/64889#M3402</link>
    <description>&lt;P&gt;Hi, I am using a saved search to display a pie chart , on clickin that i am using a postproces module to show the stats ..but its not working ?? i knew if we use the search module directly we can use the postprocess module..but this is a savedsearch module i have hiddenpostprocess module..its working for the first drilldown . but not working on the second level postprocess drilldown..Please help..&lt;/P&gt;

&lt;P&gt;My code..&lt;/P&gt;

&lt;P&gt;&lt;VIEW autocancelinterval="90" ispersistable="true" issticky="true" isvisible="true" objectmode="SimpleDashboard" onunloadcanceljobs="true" refresh="300" stylesheet="dashboard.css" template="dashboard.html"&gt;&lt;BR /&gt;
    &lt;LABEL&gt;Dashboard&lt;/LABEL&gt;&lt;BR /&gt;
    &lt;MODULE name="AccountBar" layoutpanel="appHeader"&gt;&lt;/MODULE&gt;&lt;BR /&gt;
    &lt;MODULE name="AppBar" layoutpanel="navigationHeader"&gt;&lt;/MODULE&gt;&lt;BR /&gt;
    &lt;MODULE name="Message" layoutpanel="messaging"&gt;&lt;BR /&gt;
        &lt;OBJECT&gt;&lt;PARAM name="filter" /&gt;*&lt;BR /&gt;
        &lt;PARAM name="clearOnJobDispatch" /&gt;False&lt;BR /&gt;
        &lt;PARAM name="maxSize" /&gt;1&lt;BR /&gt;
    &lt;/OBJECT&gt;&lt;/MODULE&gt;&lt;BR /&gt;
    &lt;MODULE name="SideviewUtils" layoutpanel="viewHeader"&gt;&lt;/MODULE&gt;&lt;BR /&gt;
    &lt;MODULE name="HTML" layoutpanel="panel_row1_col1"&gt;&lt;BR /&gt;
        &lt;OBJECT&gt;&lt;PARAM name="html" /&gt;&amp;lt;span class="server_header"&amp;gt;&amp;lt;center&amp;gt;&amp;lt;font size="6" face="Times New Roman" color="blue"&amp;gt;Stats  Dashboard  &amp;lt;/font&amp;gt;&amp;lt;/center&amp;gt;&amp;lt;/span&amp;gt;&lt;BR /&gt;
            &amp;lt;br&amp;gt;&lt;BR /&gt;
        &amp;lt;br&amp;gt;&lt;BR /&gt;
    &lt;/OBJECT&gt;&lt;/MODULE&gt;&lt;BR /&gt;
    &lt;MODULE name="HiddenSavedSearch" layoutpanel="panel_row2_col1" autorun="True"&gt;&lt;BR /&gt;
        &lt;OBJECT&gt;&lt;PARAM name="savedSearch" /&gt;srch_HistoricalSearch&lt;BR /&gt;
        &lt;MODULE name="HiddenPostProcess" layoutpanel="panel_row2_col1" group="Publisher Layer-Traffic Breakdown(For Past 1hr,Updated every 15 minutes)" autorun="True"&gt;&lt;BR /&gt;
            &lt;PARAM name="search" /&gt;| search gateway="A" | top Channel&lt;BR /&gt;
            &lt;PARAM name="groupLabel" /&gt;Publisher Layer-Traffic Breakdown(For Past 1hr,Updated every 15 minutes)&lt;BR /&gt;
            &lt;MODULE name="JobProgressIndicator" layoutpanel="panel_row2_col1"&gt;&lt;/MODULE&gt;&lt;BR /&gt;
            &lt;MODULE name="HiddenChartFormatter"&gt;&lt;BR /&gt;
                &lt;PARAM name="charting.chart.showPercent" /&gt;true&lt;BR /&gt;
                &lt;PARAM name="charting.chart" /&gt;pie&lt;BR /&gt;
                &lt;MODULE name="FlashChart"&gt;&lt;BR /&gt;
                    &lt;PARAM name="drilldownPrefix" /&gt;click1&lt;BR /&gt;
                    &lt;PARAM name="width" /&gt;80%&lt;BR /&gt;
                    &lt;PARAM name="height" /&gt;300px&lt;BR /&gt;
                    &lt;PARAM name="enableResize" /&gt;False&lt;BR /&gt;
                    &lt;MODULE name="HiddenPostProcess"&gt;&lt;BR /&gt;
                        &lt;PARAM name="search" /&gt;| search Channel="$click1.value$" | stats count by Channel,SiteId,Location&lt;BR /&gt;
                            &lt;MODULE name="Paginator"&gt;&lt;BR /&gt;
                            &lt;PARAM name="entityName" /&gt;events&lt;BR /&gt;
                            &lt;MODULE name="SimpleResultsTable" layoutpanel="panel_row2_col1"&gt;&lt;BR /&gt;
                                &lt;PARAM name="count" /&gt;10&lt;BR /&gt;
                                &lt;PARAM name="displayMenu" /&gt;True&lt;BR /&gt;
                                &lt;PARAM name="displayRowNumbers" /&gt;true&lt;BR /&gt;
                                &lt;MODULE name="Gimp"&gt;&lt;/MODULE&gt;&lt;BR /&gt;
                            &lt;/MODULE&gt;&lt;BR /&gt;
                        &lt;/MODULE&gt;&lt;BR /&gt;
                    &lt;/MODULE&gt;&lt;BR /&gt;
                &lt;/MODULE&gt;&lt;BR /&gt;
            &lt;/MODULE&gt;&lt;BR /&gt;
        &lt;/MODULE&gt;&lt;BR /&gt;
    &lt;/OBJECT&gt;&lt;/MODULE&gt;&lt;BR /&gt;
&lt;/VIEW&gt;&lt;/P&gt;

&lt;P&gt;Thanx&lt;/P&gt;</description>
    <pubDate>Mon, 28 Sep 2020 13:32:18 GMT</pubDate>
    <dc:creator>rakesh_498115</dc:creator>
    <dc:date>2020-09-28T13:32:18Z</dc:date>
    <item>
      <title>SavedSearch Post Process drilldown  help ??</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/SavedSearch-Post-Process-drilldown-help/m-p/64889#M3402</link>
      <description>&lt;P&gt;Hi, I am using a saved search to display a pie chart , on clickin that i am using a postproces module to show the stats ..but its not working ?? i knew if we use the search module directly we can use the postprocess module..but this is a savedsearch module i have hiddenpostprocess module..its working for the first drilldown . but not working on the second level postprocess drilldown..Please help..&lt;/P&gt;

&lt;P&gt;My code..&lt;/P&gt;

&lt;P&gt;&lt;VIEW autocancelinterval="90" ispersistable="true" issticky="true" isvisible="true" objectmode="SimpleDashboard" onunloadcanceljobs="true" refresh="300" stylesheet="dashboard.css" template="dashboard.html"&gt;&lt;BR /&gt;
    &lt;LABEL&gt;Dashboard&lt;/LABEL&gt;&lt;BR /&gt;
    &lt;MODULE name="AccountBar" layoutpanel="appHeader"&gt;&lt;/MODULE&gt;&lt;BR /&gt;
    &lt;MODULE name="AppBar" layoutpanel="navigationHeader"&gt;&lt;/MODULE&gt;&lt;BR /&gt;
    &lt;MODULE name="Message" layoutpanel="messaging"&gt;&lt;BR /&gt;
        &lt;OBJECT&gt;&lt;PARAM name="filter" /&gt;*&lt;BR /&gt;
        &lt;PARAM name="clearOnJobDispatch" /&gt;False&lt;BR /&gt;
        &lt;PARAM name="maxSize" /&gt;1&lt;BR /&gt;
    &lt;/OBJECT&gt;&lt;/MODULE&gt;&lt;BR /&gt;
    &lt;MODULE name="SideviewUtils" layoutpanel="viewHeader"&gt;&lt;/MODULE&gt;&lt;BR /&gt;
    &lt;MODULE name="HTML" layoutpanel="panel_row1_col1"&gt;&lt;BR /&gt;
        &lt;OBJECT&gt;&lt;PARAM name="html" /&gt;&amp;lt;span class="server_header"&amp;gt;&amp;lt;center&amp;gt;&amp;lt;font size="6" face="Times New Roman" color="blue"&amp;gt;Stats  Dashboard  &amp;lt;/font&amp;gt;&amp;lt;/center&amp;gt;&amp;lt;/span&amp;gt;&lt;BR /&gt;
            &amp;lt;br&amp;gt;&lt;BR /&gt;
        &amp;lt;br&amp;gt;&lt;BR /&gt;
    &lt;/OBJECT&gt;&lt;/MODULE&gt;&lt;BR /&gt;
    &lt;MODULE name="HiddenSavedSearch" layoutpanel="panel_row2_col1" autorun="True"&gt;&lt;BR /&gt;
        &lt;OBJECT&gt;&lt;PARAM name="savedSearch" /&gt;srch_HistoricalSearch&lt;BR /&gt;
        &lt;MODULE name="HiddenPostProcess" layoutpanel="panel_row2_col1" group="Publisher Layer-Traffic Breakdown(For Past 1hr,Updated every 15 minutes)" autorun="True"&gt;&lt;BR /&gt;
            &lt;PARAM name="search" /&gt;| search gateway="A" | top Channel&lt;BR /&gt;
            &lt;PARAM name="groupLabel" /&gt;Publisher Layer-Traffic Breakdown(For Past 1hr,Updated every 15 minutes)&lt;BR /&gt;
            &lt;MODULE name="JobProgressIndicator" layoutpanel="panel_row2_col1"&gt;&lt;/MODULE&gt;&lt;BR /&gt;
            &lt;MODULE name="HiddenChartFormatter"&gt;&lt;BR /&gt;
                &lt;PARAM name="charting.chart.showPercent" /&gt;true&lt;BR /&gt;
                &lt;PARAM name="charting.chart" /&gt;pie&lt;BR /&gt;
                &lt;MODULE name="FlashChart"&gt;&lt;BR /&gt;
                    &lt;PARAM name="drilldownPrefix" /&gt;click1&lt;BR /&gt;
                    &lt;PARAM name="width" /&gt;80%&lt;BR /&gt;
                    &lt;PARAM name="height" /&gt;300px&lt;BR /&gt;
                    &lt;PARAM name="enableResize" /&gt;False&lt;BR /&gt;
                    &lt;MODULE name="HiddenPostProcess"&gt;&lt;BR /&gt;
                        &lt;PARAM name="search" /&gt;| search Channel="$click1.value$" | stats count by Channel,SiteId,Location&lt;BR /&gt;
                            &lt;MODULE name="Paginator"&gt;&lt;BR /&gt;
                            &lt;PARAM name="entityName" /&gt;events&lt;BR /&gt;
                            &lt;MODULE name="SimpleResultsTable" layoutpanel="panel_row2_col1"&gt;&lt;BR /&gt;
                                &lt;PARAM name="count" /&gt;10&lt;BR /&gt;
                                &lt;PARAM name="displayMenu" /&gt;True&lt;BR /&gt;
                                &lt;PARAM name="displayRowNumbers" /&gt;true&lt;BR /&gt;
                                &lt;MODULE name="Gimp"&gt;&lt;/MODULE&gt;&lt;BR /&gt;
                            &lt;/MODULE&gt;&lt;BR /&gt;
                        &lt;/MODULE&gt;&lt;BR /&gt;
                    &lt;/MODULE&gt;&lt;BR /&gt;
                &lt;/MODULE&gt;&lt;BR /&gt;
            &lt;/MODULE&gt;&lt;BR /&gt;
        &lt;/MODULE&gt;&lt;BR /&gt;
    &lt;/OBJECT&gt;&lt;/MODULE&gt;&lt;BR /&gt;
&lt;/VIEW&gt;&lt;/P&gt;

&lt;P&gt;Thanx&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 13:32:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/SavedSearch-Post-Process-drilldown-help/m-p/64889#M3402</guid>
      <dc:creator>rakesh_498115</dc:creator>
      <dc:date>2020-09-28T13:32:18Z</dc:date>
    </item>
    <item>
      <title>Re: SavedSearch Post Process drilldown  help ??</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/SavedSearch-Post-Process-drilldown-help/m-p/64890#M3403</link>
      <description>&lt;P&gt;You're using Splunk's HiddenPostProcess module, and not Sideview's PostProcess module. &lt;/P&gt;

&lt;P&gt;Splunk's HiddenPostProcess module can not do any kind of $foo$ substitution, so that $click.value$ token you have is just not being substituted. &lt;/P&gt;</description>
      <pubDate>Tue, 19 Mar 2013 05:05:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/SavedSearch-Post-Process-drilldown-help/m-p/64890#M3403</guid>
      <dc:creator>sideview</dc:creator>
      <dc:date>2013-03-19T05:05:49Z</dc:date>
    </item>
  </channel>
</rss>

