Splunk Search

Splunk and Drilling down into Charts

New Member


I am using a Pie chart and I want to be able to drill down into see the results, but when I try this, I get the following error message
PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'replace' command

Here is the search I am using
host=MTSFARM-13U-PTCSWSEIU1 Status="PreInboundProcessorSelector" | top ProcessorLookup limit="25"
| replace "DELIVERY_REPORT_1_PROCESSOR" with "Delivery Report 1" in ProcessorLookup
| replace "REJECTED_DELIVERY_REPORT_2_PROCESSOR" with "Rejected Delivery Report 2" in ProcessorLookup

I need to use the replace command so that the pie chart can have meaningful values in the Legend.
Is there anyway to have meaningful values on my chart and still be able to drill down into the chart?

Tags (1)
0 Karma


Some commands that change the data including replace do not map well to automated drilldown. In those cases, you will need to use advanced XML and specify the drildown search.

A good explanation of this is given here


State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!