Sideview Utils: Why is my post process search not displaying results for a Discovered Field?

[jward6004]

I'm creating a dashboard using SideView Editor in Splunk Enterprise 6.5.1...

I'm having trouble displaying results using the following basic search:

index=iis_order OR index=webapps host=order* `ignore_traffic`

(ignore_traffic is an internal macro)

The issue is using a postprocess under that basic searc : (the field AppDomain appears to be a Discovered Field)

AppDomain="*OrderProcess*" 
| rex field=AppDomain "^\/([^\/]+\/){4}(?[^-]+)" 
| rename AppDomain as Application 
| eval Source_Exception = SourceName.":".Exception_Message
| stats count(Source_Exception) as Total by Source_Exception, _time, Application 
| table _time, Application, Source_Exception
| sort Application

I would like a SimpleResultsTable display a table for _time, Application, Source_Exception. However, I get the following error displayed in my panel:

The job appears to have expired or has been cancelled. Splunk could not retrieve data for this search.

I've also tried to simplify my postprocess to test using queries like stats count by {field_extraction} and cannot get the panel to return a result. I seem to only be able to return data when using a built-in field.

[sideview]

Splunk does a lot of clever things when the search is dispatched, to avoid doing unnecessary work. In particular it won't extract a given field if it doesn't see any evidence that it needs to. Since your postProcess search only comes along after the search has been kicked off, your field wont be there.

There are actually several different pitfalls that people fall into with postprocess. It used to be some great docs were hidden inside later versions of the Sideview Utils app itself (Key Techniques > Intro to postprocess) but I just fished those docs out and posted them here:

http://sideviewapps.com/1796/postprocess-searches-pitfalls-galore/

[somesoni2]

You should include a table or fields command in the base search to explicitly list all the fields that you want to use in post-process searches.