Dashboards & Visualizations

Not accurate data after transpose implemented- How to fix?

bigll
Path Finder

Hi.

I have two panel dashboard. One is general status of cluster and another one details for selected cluster. 
---------
Panel 1
--------

`myapp_get_index` sourcetype="myapp:pce:metadata" myapp_type="myapp:pce:health"
|stats values(status) as status by fqdn
|rename fqdn as FQDN
| eval "Cluster Status" = upper(substr(status,0,1)) + lower(substr(status,2))
|fields - status


-----------------------
Panel 2
--------------

`myapp_get_index` sourcetype="myapp:pce:metadata" myapp_type="myapp:pce:health" fqdn=$fqdn$
| head 1
|spath path="nodes{}" output=nodes
| mvexpand nodes
|table nodes
|spath input=nodes
|eval "Uptime Day"=round(uptime_seconds/60/60,0)
|table hostname, ip_address, type, cpu.percent, disk{}.location, disk{}.value.percent,memory.percent,services.running{},services.status, "Uptime Day"


-----
This code works.
I added transpose command to panel 1
--------------

 `myapp_get_index` sourcetype="myapp:pce:metadata" myapp_type="myapp:pce:health"
|stats values(status) as status by fqdn
|rename fqdn as FQDN
|eval "Cluster Status" = upper(substr(status,0,1)) + lower(substr(status,2))
|fields - status
|transpose 5
|fields - column
| rename column as FQDN,"row 1" as "FQDN 1", "row 2" as "FQDN 2", "row 3" as "FQDN 3", "row 4" as "FQDN 4", "row 5" as "FQDN 5"


------------------
It shows data as I wanted in panel1, but in panel 2 it shows details only for first FQDN regardless what I click on.
-----------------------
I could not pinpoint what is missing.

Thank you in advance.

Labels (2)
0 Karma

bigll
Path Finder

<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="fqdn">$click.value$</set>
</drilldown>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

So you aren't changing the drilldown when you add the transpose?

You possibly need to use $click.name2$ after transpose instead of $click.value$?

bigll
Path Finder

Thank you for an advise.
I changed drilldown to 
<drilldown>
<set token="fqdn">$click.name2$</set>
</drilldown>
It moves closer, but did not solve the issue.
That grabs column title, but not a FQDN value
I.e.  values in the query "fqdn=FQDN 3" and not a "server3.path.org"
screen1.jpg

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK then you want $click.value2$

$click.name$ $click.name2$
   
$click.value$ $click.value2$
0 Karma

bigll
Path Finder

THANK YOU. 😁

That did the trick.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you have in your drilldown for each instance i.e. before and after you add the transpose?

0 Karma

bigll
Path Finder

Hi.

Before transpose I have in panel 2 details for each cluster after I click on FQDN in top panel (panel1)
After transpose I have the same data, but only for FQDN #1 regardless on what FQ DN I click on in panel 1 

TIA

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

And what do you have configured for the drilldown actions in each of those instances?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...