topic Why is dashboard studio column formatting array? in Dashboards & Visualizations

Why is dashboard studio column formatting array?

Skins — Tue, 14 Feb 2023 16:37:18 GMT

I'm looking to add some column formatting to some table in dashboard studio - but the option is greyed out saying the column is an array, why is this ? and can i re-factor my search to make it work?

index=test AND host="test" sourcetype=test
| stats latest(state) latest(status) by host name state status
| stats list(name) as NAME list(state) as STATE list(status) as STATUS by hos

Re: dashboard studio column formatting array

ITWhisperer — Tue, 14 Feb 2023 07:19:54 GMT

The stats command is creating three multivalue fileds (arrays) - these appear to be superfluous as the previous stats command has already created a set of events with exactly the same information in. Try removing the last stats command.

Re: dashboard studio column formatting array

Skins — Tue, 14 Feb 2023 09:26:34 GMT

Thanks!, but the last stats command presents the data in list format as i want.
if i remove that it doesnt give the desired output?

Re: dashboard studio column formatting array

ITWhisperer — Tue, 14 Feb 2023 09:35:53 GMT

You could use mvjoin to convert the multivalue fields into single fields - does that help?

Re: dashboard studio column formatting array

Skins — Tue, 14 Feb 2023 12:45:21 GMT

nope that removes the list formatting - desired output looks like this:

host NAME STATE STATUS

host

Disk 0

Disk 1

Disk 2

Disk 3

Disk 4

Online