Why value 0 always align left?

[MirrorCraze]

Every time I create a table visualization, I notice that the value 0 is always aligned on the left side while the rest is aligned on the right side. (322, 3483,0,0 is in the same column)

MirrorCraze_0-1702935350607.png

Is there any reason behind it and any way to fix this? Thanks!

[ITWhisperer]

By default, strings are aligned left and numerics are aligned right - for some reason your 0 is a string. Please check your search, or post it with some sample data so we can investigate further.

[MirrorCraze]

Sure! Let me try to give partial of my data here.

{
host :host01
metrics:

{    
     Started: true
     TotalConnectionCount: 0
     Uptime: 3 days 3 hours
     UptimeMillis: 271021770
}
}

My search query involving the field that have problem is something like this.

<search query> | spath output=metrics path=metrics | stats latest(metrics.Started) as started, latest(metrics.TotalConnectionCount) as connectionCount by host |eval state = if(started="true","UP","DOWN") 
| table host, state, connectionCount

The problem comes with connectionCount. If it's not 0, it aligns right. If it's 0, it aligns left.

Ps. Actually after I investigate this, this problem does not occur on Splunk search, but on the Splunk Dashboard Studio when I use the table on my dashboard. Any ideas?

[ITWhisperer]

Dashboard Studio is still under development so some features which are available in SimpleXML / Classic dashboards are either not available or not fully working, it will depend on which version of Splunk you are using.

[bowesmana]

What's the query and data that this comes from?