Solved: Why am I losing table formatting when using the re...

ppatrikfr · ‎10-23-2018

Hello,

I have a search that i want to take zeros off of. But, when i do it with replace, it loses its table formatting. Can anyone help me?

Obs.: As I'm using the timechart command, I can't use "if statement" in search because column names always change.

Code block i'm allowed to post!

| timechart span=1mon count by "Secao" limit=0 usenull=f useother=f cont=false 
| eval mes=strftime(_time,"%B %Y") 
| fields - _time span _spandays 
| transpose 0 header_field=mes column_name="Secao" 
| eval Secao=if(Secao="NULL","Other",Secao) 
| eval Departamento=if(Departamento="NULL","Other",Departamento) 
| eval Equipe=if(Equipe="NULL","Other",Equipe) 
| addtotals
| replace "0" with " "

Before replace:

After replace:

ppatrikfr · ‎10-23-2018

I solved my own problem by using a simple CSS style. I don't know if It's the right way but it works.
If you have any other solution, i'll be glad to hear and discuss about. Tks

  <panel>
          <html depends="$alwaysHideCSS$">
             <style>
                   #table_to_change .table th, .table td {
                        text-align: right!important;
                    }
             </style>
         </html>
          <table>
            <search id="table_to_change" base="base">
              <query> "Your query goes here :)" </query>
            </search>
            <option name="count">50</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">none</option>
            <option name="rowNumbers">false</option>
          </table>
        </panel>

View solution in original post

ppatrikfr · ‎10-23-2018

I solved my own problem by using a simple CSS style. I don't know if It's the right way but it works.
If you have any other solution, i'll be glad to hear and discuss about. Tks

  <panel>
          <html depends="$alwaysHideCSS$">
             <style>
                   #table_to_change .table th, .table td {
                        text-align: right!important;
                    }
             </style>
         </html>
          <table>
            <search id="table_to_change" base="base">
              <query> "Your query goes here :)" </query>
            </search>
            <option name="count">50</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">none</option>
            <option name="rowNumbers">false</option>
          </table>
        </panel>

Why am I losing table formatting when using the replace command?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Auto Ingestion Parallel Pipeline Scaling

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation