Sideview: Table as EventsViewer Filter

[snoobzilla]

I am trying to do something that seems like it should be fairly simple, but I am stuck.

In a nutshell, I am using a table. When I select a row I want the corresponding event only to display in EventsViewer.

I have a search that returns events. When I put an EventsViewer directly below the table all of the events in the table display.

It seems like I should be able to do something like put a postprocess below the table with search...

FIELD=$row.fields.FIELD$

Where FIELD is distinct value for row. However, when I do this I get no results. What am I missing? I have tried all sorts of permutations of post processing.

Sideview Utils 3.2.6 do I need to upgrade?

[snoobzilla · Accepted solution]

Ok, problem was post process search.... needed to be "search FIELD=$row.fields.FIELD$" not just "FIELD=$row.fields.FIELD$". Clearly I hadn't been using post process searches much.

[sideview]

No no. hehe. the search-time extraction is fine. You just have to think a little differently about the base search. No matter what the base search is, you can construct it a little differently and you'll be fine. The docs page will explain all this. "Key Techniques - Using PostProcess - Introduction"

[snoobzilla]

Thanks Nick.

Sorry I missed that, will review and see if I can eliminate search time extractions.

[sideview]

Have you reviewed the pitfalls detailed in the PostProcess intro page in the Sideview docs? That's always my first stop when postprocess is involved. ie if the field isn't explicitly named in the base search and it's a search-time field extraction, you wont be able to filter on it in postprocess searches.