topic Re: Chart count result process - replace zero with SPACE for particular cell in Splunk Enterprise

Chart count result process - replace zero with SPACE for particular cell

rally0321 — Fri, 29 Apr 2022 09:30:13 GMT

I get below result when use Chart count over field-A by Field-B

We can see there are cell with value 0, is there any solution to replace these 0 with SPACE for particular cell? Thanks. replace 0 for over value 1 + by field value 1/4; replace 0 for over value 2 + by field value 3/5.

Over field value	by field value1	by field value2	by field value3	by field value 4	by field value5	Total
Over value 1	0	0	1	0	0	1
Over value 2	0	0	0	603	0	603
Over value 3	0	0	12	0	0	12
Over value 4	0	0	0	600	0	600

Re: Chart count result process - replace zero with SPACE for particular cell

ITWhisperer — Fri, 29 Apr 2022 09:49:21 GMT

Try something like this:

| foreach * [| eval "<<FIELD>>"=if('<<FIELD>>'=0," ",'<<FIELD>>')]

Re: Chart count result process - replace zero with SPACE for particular cell

rally0321 — Fri, 29 Apr 2022 10:35:06 GMT

above command will replace 0 to space for all cells. Can we somehow replace the cell for selected row/column only?

for example replace 0 in row 2, column 2/5 to SPACE and leave 0 in row 2, column 3/6.

Re: Chart count result process - replace zero with SPACE for particular cell

ITWhisperer — Fri, 29 Apr 2022 15:25:36 GMT

| eval "by field value2" = if('Over field value'="Over value 2" AND 'by field value2'=0, " ", 'by field value2')