Splunk and Drilling down into Charts

[damogallagher]

Hi

I am using a Pie chart and I want to be able to drill down into see the results, but when I try this, I get the following error message
PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'replace' command

Here is the search I am using
host=MTSFARM-13U-PTCSWSEIU1 Status="PreInboundProcessorSelector" | top ProcessorLookup limit="25"
| replace "DELIVERY_REPORT_1_PROCESSOR" with "Delivery Report 1" in ProcessorLookup
| replace "REJECTED_DELIVERY_REPORT_2_PROCESSOR" with "Rejected Delivery Report 2" in ProcessorLookup

I need to use the replace command so that the pie chart can have meaningful values in the Legend.
Is there anyway to have meaningful values on my chart and still be able to drill down into the chart?

[BobM]

Some commands that change the data including replace do not map well to automated drilldown. In those cases, you will need to use advanced XML and specify the drildown search.

A good explanation of this is given here

[http://www.splunk.com/base/Documentation/latest/Developer/TableChartDrilldown]http://www.splunk.com/...]