- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why is dashboard studio column formatting array?
Skins
Path Finder
02-13-2023
10:22 PM
I'm looking to add some column formatting to some table in dashboard studio - but the option is greyed out saying the column is an array, why is this ? and can i re-factor my search to make it work?
index=test AND host="test" sourcetype=test
| stats latest(state) latest(status) by host name state status
| stats list(name) as NAME list(state) as STATE list(status) as STATUS by hos
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Skins
Path Finder
02-14-2023
01:21 AM
Thanks!, but the last stats command presents the data in list format as i want.
if i remove that it doesnt give the desired output?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
02-14-2023
01:35 AM
You could use mvjoin to convert the multivalue fields into single fields - does that help?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Skins
Path Finder
02-14-2023
04:43 AM
nope that removes the list formatting - desired output looks like this:
host NAME STATE STATUS
host | Disk 0 Disk 1 Disk 2 Disk 3 Disk 4 | Online Online Online Online Online | Up Up Up Up Up |
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
02-13-2023
11:19 PM
The stats command is creating three multivalue fileds (arrays) - these appear to be superfluous as the previous stats command has already created a set of events with exactly the same information in. Try removing the last stats command.
