UPDATE:
You are absolutely right - there is a bug here. The Events module will incorporate the postprocess search when it makes its requests, but if the postprocess search changes later on and nothing else upstream changes, the Events module will not realize it should re-request the events. This is a bug and I'll fix it in the next release. Thanks.
Original Answer:
The Events module does indeed work with postprocess searches. However events and postprocess searches are very tricky to work with together at the Splunk API level. Read the Sideview Utils App's "Introduction to PostProcess" docs page carefully. That page will walk you through the pitfalls associated with using postProcess searches, and those pitfalls get much easier to fall into when you're dealing with a 'raw events' search.
Specifically, what's probably happening is that your postProcess search is referencing one or more extracted fields, but those fields are not referenced explicitly in the syntax of the base search. When this happens splunkd will optimize it away at search dispatch time - those fields will be neither extracted nor preserved. Then when the postprocess search tries to filter by that field it is not there.
However it could also be one of the other pitfalls potentially. The page can tell you more. While sometimes you can fix these shenanigans around raw events + postprocess by putting a fields clause into your base search (or tacking one on for the user behind the scenes), it's important to be aware of all the pitfalls involved.
