Splunk Search

Why am I losing table formatting when using the replace command?

ppatrikfr
Path Finder

Hello,

I have a search that i want to take zeros off of. But, when i do it with replace, it loses its table formatting. Can anyone help me?

Obs.: As I'm using the timechart command, I can't use "if statement" in search because column names always change.

Code block i'm allowed to post!

| timechart span=1mon count by "Secao" limit=0 usenull=f useother=f cont=false 
| eval mes=strftime(_time,"%B %Y") 
| fields - _time span _spandays 
| transpose 0 header_field=mes column_name="Secao" 
| eval Secao=if(Secao="NULL","Other",Secao) 
| eval Departamento=if(Departamento="NULL","Other",Departamento) 
| eval Equipe=if(Equipe="NULL","Other",Equipe) 
| addtotals
| replace "0" with " "

Before replace:
alt text

After replace:

alt text

0 Karma
1 Solution

ppatrikfr
Path Finder

I solved my own problem by using a simple CSS style. I don't know if It's the right way but it works.
If you have any other solution, i'll be glad to hear and discuss about. Tks

  <panel>
          <html depends="$alwaysHideCSS$">
             <style>
                   #table_to_change .table th, .table td {
                        text-align: right!important;
                    }
             </style>
         </html>
          <table>
            <search id="table_to_change" base="base">
              <query> "Your query goes here :)" </query>
            </search>
            <option name="count">50</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">none</option>
            <option name="rowNumbers">false</option>
          </table>
        </panel>

View solution in original post

0 Karma

ppatrikfr
Path Finder

I solved my own problem by using a simple CSS style. I don't know if It's the right way but it works.
If you have any other solution, i'll be glad to hear and discuss about. Tks

  <panel>
          <html depends="$alwaysHideCSS$">
             <style>
                   #table_to_change .table th, .table td {
                        text-align: right!important;
                    }
             </style>
         </html>
          <table>
            <search id="table_to_change" base="base">
              <query> "Your query goes here :)" </query>
            </search>
            <option name="count">50</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">none</option>
            <option name="rowNumbers">false</option>
          </table>
        </panel>
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Make Your Machine Data AI-Ready in Splunk

Every team is getting ready for AI agents.   Thursday, November 12, 2026  |  11AM  PST / 2PM EST   ...

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...

How to Monitor AI Agents with Splunk Agent Observability

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...