Using Postprocess to create Table with a Drilldown

[cmak]

In one of my apps, I have a Search module, and then have a PostProcess module which populates a Table Module. The table module also has drilldown capability.

If I use Search instead of PostProcess to populate the table, the Drilldown disappears when the table is refreshed. (When a pulldown is modified)

However, when I use postprocess, the table does not actually refresh when the pulldown is changed, and its contents simply change. The drilldown is still present, even though the table has changed.

Note: The drilldown itself is running off of a postprocess Module

Is there a way to fix this?

[sideview]

This is a bug. Thanks Calvin for reporting it and sorry I didn't recognize it as such right away.

The SimpleResultsTable module has the same bug and I can't promise that I can fix it over there, but I can fix it in the Table module at least.

I'll try to get the fix into the next version of Utils (2.4.1). If you need a workaround sooner you can actually nest the whole thing inside these weird fellow:

<module name="Search">
  <param name="search">| stats count</param>
  <module name="CustomBehavior">
    <param name="requiresDispatch">True</param>
    .. Pager, clickable Table and all it's nested drilldown config goes here... 

Because as you now know, the dispatching of that random little | stats count search will have a side effect of resetting all the downstream modules.

[cmak]

But wouldn't this replace my original search?
I have 1 search at the very top, and all my pulldowns and tables below post process from this one search. Placing this little snippet anywhere seems to change my original search?

[sideview]

It doesn't really matter. I'm not saying anything will actually use that | stats count search - just it's presence there stitched into the flow will produce the behavior that any new push from above that point, will call reset on all the Table's below.... does that make sense? You would still leave every one of your PostProcess and all that above and below this little block, upstream from and downstream from, as appropriate.

[cmak]

I realized this bit of code does not work in my case :(. I use 1 search and postprocesses to generate my pulldowns. I then use more postprocesses from the same original search to generate my tables.

[cmak]

I would like to clear the drilldown modules :). Similar to how the normal search works, as the table looks like it gets reloaded, and the drilldown is now cleared.

[sideview]

More details would help. For instance which behavior do you want to "fix" - do you want the Search config to not clear the drilldown modules or do you want the postprocess config to clear the drilldown modules. Also, if the fix you want is to have the drilldown config not dissappear with the search config, then this looks a bit like a duplicate of your other question here -- http://splunk-base.splunk.com/answers/76126/table-is-being-reloaded-before-button-is-pressed In other words the behavior is just the behavior of reset() as I described in my answer there.