Why am I losing table formatting when using the replace command?

ppatrikfr — Tue, 23 Oct 2018 13:06:05 GMT

Hello,

I have a search that i want to take zeros off of. But, when i do it with replace, it loses its table formatting. Can anyone help me?

Obs.: As I'm using the timechart command, I can't use "if statement" in search because column names always change.

Code block i'm allowed to post!

| timechart span=1mon count by "Secao" limit=0 usenull=f useother=f cont=false 
| eval mes=strftime(_time,"%B %Y") 
| fields - _time span _spandays 
| transpose 0 header_field=mes column_name="Secao" 
| eval Secao=if(Secao="NULL","Other",Secao) 
| eval Departamento=if(Departamento="NULL","Other",Departamento) 
| eval Equipe=if(Equipe="NULL","Other",Equipe) 
| addtotals
| replace "0" with " "

Before replace:

After replace:

Re: Why am I losing table formatting when using the replace command?

ppatrikfr — Tue, 23 Oct 2018 13:26:01 GMT

I solved my own problem by using a simple CSS style. I don't know if It's the right way but it works.
If you have any other solution, i'll be glad to hear and discuss about. Tks

  <panel>
          <html depends="$alwaysHideCSS$">
             <style>
                   #table_to_change .table th, .table td {
                        text-align: right!important;
                    }
             </style>
         </html>
          <table>
            <search id="table_to_change" base="base">
              <query> "Your query goes here :)" </query>
            </search>
            <option name="count">50</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">none</option>
            <option name="rowNumbers">false</option>
          </table>
        </panel>

topic Re: Why am I losing table formatting when using the replace command? in Splunk Search

Why am I losing table formatting when using the replace command?

Re: Why am I losing table formatting when using the replace command?