Chart count result process - replace zero with SPACE

[rally0321]

I get below result when use Chart count over field-A by Field-B

We can see there are cell with value 0, is there any solution to replace these 0 with SPACE? Thanks.

Over field value	by field value1	by field value2	by field value3	by field value 4	by field value5	Total
Over value 1	0	0	1	0	0	1
Over value 2	0	0	0	603	0	603
Over value 3	0	0	12	0	0	12
Over value 4	0	0	0	600	0	600

[PickleRick · Accepted solution]

Sure.

| foreach by* [  eval '<<FIELD>>'=if('<<FIELD>>'=0," ",'<<FIELD>>') ]

Are you sure you don't want an empty string or null value?

[rally0321]

Thanks PickleRick,

I can have below result now, however we can see the number is left-justify now, how can we make it right-justify instead? 

Description	AA	CC	HH	NN	MM	PP	SS	TT	VV
A	11	15	78	10	17	16	94	1
B			1				7
C					25
D	107		31	28	975	184	308
E	4	31	181	1	22	40	5		3

[PickleRick]

The search only returns data. Formatting is up to your visualization.

[rally0321]

Before use foreach command to replace zero with SPACE, I can see the string table data is left-justify and numeric data is right-justify 

After "foreach", I can see 7 numeric column data is left-justify and only 1 numeric column data is right-justify.

[rally0321]

Understand that, as per the Splunk manual I can see below attribute for table column number format.

    <format type="number" field="count">
        <option name="precision">3</option>
        <option name="useThousandSeparators">false</option>
        <option name="unit">MB</option>
        <option name="unitPosition">before</option>
    </format>   

 If we use table as visualization solution, can we specify how the number justify?

Similarly, I see some table column head/title is left-justify and a few is right-justify. 

Is there any solution to align the same justification? Thanks.