topic Re: Chart count result process - replace zero with SPACE in Splunk Enterprise

Chart count result process - replace zero with SPACE

rally0321 — Fri, 10 Sep 2021 09:01:00 GMT

I get below result when use Chart count over field-A by Field-B

We can see there are cell with value 0, is there any solution to replace these 0 with SPACE? Thanks.

Over field value	by field value1	by field value2	by field value3	by field value 4	by field value5	Total
Over value 1	0	0	1	0	0	1
Over value 2	0	0	0	603	0	603
Over value 3	0	0	12	0	0	12
Over value 4	0	0	0	600	0	600

Re: Chart count result process - replace zero with SPACE

PickleRick — Fri, 10 Sep 2021 09:17:22 GMT

Sure.

| foreach by* [  eval '<<FIELD>>'=if('<<FIELD>>'=0," ",'<<FIELD>>') ]

Are you sure you don't want an empty string or null value?

Re: Chart count result process - replace zero with SPACE

rally0321 — Mon, 13 Sep 2021 11:09:53 GMT

Thanks PickleRick,

I can have below result now, however we can see the number is left-justify now, how can we make it right-justify instead?

Description	AA	CC	HH	NN	MM	PP	SS	TT	VV
A	11	15	78	10	17	16	94	1
B			1				7
C					25
D	107		31	28	975	184	308
E	4	31	181	1	22	40	5		3

Re: Chart count result process - replace zero with SPACE

PickleRick — Mon, 13 Sep 2021 14:18:08 GMT

The search only returns data. Formatting is up to your visualization.

Re: Chart count result process - replace zero with SPACE

rally0321 — Tue, 14 Sep 2021 04:21:01 GMT

Understand that, as per the Splunk manual I can see below attribute for table column number format.

    <format type="number" field="count">
        <option name="precision">3</option>
        <option name="useThousandSeparators">false</option>
        <option name="unit">MB</option>
        <option name="unitPosition">before</option>
    </format>

If we use table as visualization solution, can we specify how the number justify?

Similarly, I see some table column head/title is left-justify and a few is right-justify.

Is there any solution to align the same justification? Thanks.

Re: Chart count result process - replace zero with SPACE

rally0321 — Tue, 14 Sep 2021 09:06:38 GMT

Before use foreach command to replace zero with SPACE, I can see the string table data is left-justify and numeric data is right-justify

After "foreach", I can see 7 numeric column data is left-justify and only 1 numeric column data is right-justify.