Your solution works, though I was being tripped up by two separate "option" clauses. I had drill downs enabled on my table, but left the other options default. This left the base "options" clause out, but a second "options" clause was nested on the eventHandlers clause. I had to change something to fix this. In my case, I turned on Column Formatting for two of the fields in the table. This is my table with your alignment option added. Thanks! "viz_tbl_cnt_by_user": {
"type": "splunk.table",
"dataSources": {
"primary": "ds_qWJPJZ6C"
},
"eventHandlers": [
{
"type": "drilldown.setToken",
"options": {
"tokens": [
{
"token": "tkn_user",
"key": "row.identity.value"
}
]
}
}
],
"options": {
"tableFormat": {
"align": "> table |pick(alignment)"
},
"columnFormat": {
"identity": {
"data": "> table | seriesByName(\"identity\") | formatByType(identityColumnFormatEditorConfig)"
},
"usernames": {
"data": "> table | seriesByName(\"usernames\") | formatByType(usernamesColumnFormatEditorConfig)"
}
}
},
"context": {
"identityColumnFormatEditorConfig": {
"string": {
"unitPosition": "after"
}
},
"usernamesColumnFormatEditorConfig": {
"string": {
"unitPosition": "after"
}
},
"alignment": [
"left"
]
}
}
... View more