Issue with Postprocessing

[theouhuios]

Hello

I am trying to use postprocessing and having issues with it. Can anyone please help me out in understanding where am I going wrong here.

<?xml version='1.0' encoding='utf-8'?>

Service Operation - Outages and Notification Dashboard sourcetype="incident" record.groupDepartment="*" record.groupArea="*" record.assignmentGroup="*"| dedup record.incidentId|timechart span=1hr count by record.eventType usenull=f | addtotals create , update | fields - create , update

Department: * All Systems Agency Area: * All Architecture and Engineering Systems Technology Product Solutions Systems Projects Customer Connection Solutions Channel Support General and Financial Services Data and amp; Information Strategies P and amp;C Claims Systems Customer Relationship Management Not Defined Product Solutions WorkGroup: *

earliest=-24h@h latest=@h | search record.groupDepartment="$Dept$" record.groupArea="$Area$" record.assignmentGroup="$WG$" Time column gaps stacked false right 20 true all earliest=-31d@d latest=@d | search record.groupDepartment="$Dept$" record.groupArea="$Area$" record.assignmentGroup="$WG$" Time column stacked 10 true

Regards

theou

[jonuwz]

You cant use values generated from selectors / intentions in post process.

Its a limitation, and the bane of my life.

sideview utils works around this - its a cool app.

[sideview]

Yep. Sideview Utils fills a lot of gaps like this. In this particular case it has PostProcess module to replace HiddenPostProcess. Not only can you do $foo$ substitution into PostProcess searches, but you don't have to think about intentions at all ever again -- the substitution is right from the raw tokens into the $foo$. No intention middleman. Also the Pulldown and TextField modules are much easier to use than the core equivalents. remember to get the latest version (2.2.2) from the Sideview site. The version on Splunkbase is actually quite old.