Splunk Enterprise

Chart count result process - replace zero with SPACE for particular cell

rally0321
Path Finder

I get below result when use Chart count over field-A by Field-B

We can see there are cell with value 0, is there any solution to replace these 0 with SPACE for particular cell? Thanks.   replace 0 for over value 1 + by field value 1/4;  replace 0 for over value 2 + by field value 3/5.

Over field value

by field value1

by field value2

by field value3

by field value 4

by field value5

Total

Over value 1

0

0

1

0

0

1

Over value 2

0

0

0

603

0

603

Over value 3

0

0

12

0

0

12

Over value 4

0

0

0

600

0

600

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval "by field value2" = if('Over field value'="Over value 2" AND 'by field value2'=0, " ", 'by field value2')

View solution in original post

rally0321
Path Finder

above command will replace 0 to space for all cells. Can we somehow replace the cell for selected row/column only? 

for example replace 0 in row 2, column 2/5 to SPACE and leave 0 in row 2,  column 3/6. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval "by field value2" = if('Over field value'="Over value 2" AND 'by field value2'=0, " ", 'by field value2')

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this:

| foreach *
  [| eval "<<FIELD>>"=if('<<FIELD>>'=0," ",'<<FIELD>>')]
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...