@magnew, thanks for the reply.
I did some more research on this and what it turned out to be was this. My query, which I had edited for this post to avoid confusion with other readers, was actually more like this:
| table cluster node latency color clusterNode
Note the 5th field, clusterNode. With other classic Splunk visualizations, I often rely on a field not represented in the visualization as the source for my drilldown link.
It turns out, with the new Punchcard visualization, using fields not shown in the visualization doesn't work. So I had to rework my drilldown link (and destination views) to use a combination of the first two fields (cluster, node) as the necessary values to get where I was going.
I hope this research helps others avoid similar miscues and lost time.
... View more