Dashboards & Visualizations

Not accurate data after transpose implemented- How to fix?

bigll
Path Finder

Hi.

I have two panel dashboard. One is general status of cluster and another one details for selected cluster. 
---------
Panel 1
--------

`myapp_get_index` sourcetype="myapp:pce:metadata" myapp_type="myapp:pce:health"
|stats values(status) as status by fqdn
|rename fqdn as FQDN
| eval "Cluster Status" = upper(substr(status,0,1)) + lower(substr(status,2))
|fields - status


-----------------------
Panel 2
--------------

`myapp_get_index` sourcetype="myapp:pce:metadata" myapp_type="myapp:pce:health" fqdn=$fqdn$
| head 1
|spath path="nodes{}" output=nodes
| mvexpand nodes
|table nodes
|spath input=nodes
|eval "Uptime Day"=round(uptime_seconds/60/60,0)
|table hostname, ip_address, type, cpu.percent, disk{}.location, disk{}.value.percent,memory.percent,services.running{},services.status, "Uptime Day"


-----
This code works.
I added transpose command to panel 1
--------------

 `myapp_get_index` sourcetype="myapp:pce:metadata" myapp_type="myapp:pce:health"
|stats values(status) as status by fqdn
|rename fqdn as FQDN
|eval "Cluster Status" = upper(substr(status,0,1)) + lower(substr(status,2))
|fields - status
|transpose 5
|fields - column
| rename column as FQDN,"row 1" as "FQDN 1", "row 2" as "FQDN 2", "row 3" as "FQDN 3", "row 4" as "FQDN 4", "row 5" as "FQDN 5"


------------------
It shows data as I wanted in panel1, but in panel 2 it shows details only for first FQDN regardless what I click on.
-----------------------
I could not pinpoint what is missing.

Thank you in advance.

Labels (2)
0 Karma

bigll
Path Finder

<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="fqdn">$click.value$</set>
</drilldown>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

So you aren't changing the drilldown when you add the transpose?

You possibly need to use $click.name2$ after transpose instead of $click.value$?

bigll
Path Finder

Thank you for an advise.
I changed drilldown to 
<drilldown>
<set token="fqdn">$click.name2$</set>
</drilldown>
It moves closer, but did not solve the issue.
That grabs column title, but not a FQDN value
I.e.  values in the query "fqdn=FQDN 3" and not a "server3.path.org"
screen1.jpg

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK then you want $click.value2$

$click.name$ $click.name2$
   
$click.value$ $click.value2$
0 Karma

bigll
Path Finder

THANK YOU. 😁

That did the trick.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you have in your drilldown for each instance i.e. before and after you add the transpose?

0 Karma

bigll
Path Finder

Hi.

Before transpose I have in panel 2 details for each cluster after I click on FQDN in top panel (panel1)
After transpose I have the same data, but only for FQDN #1 regardless on what FQ DN I click on in panel 1 

TIA

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

And what do you have configured for the drilldown actions in each of those instances?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...