Splunk Search

Why am I losing table formatting when using the replace command?

ppatrikfr
Path Finder

Hello,

I have a search that i want to take zeros off of. But, when i do it with replace, it loses its table formatting. Can anyone help me?

Obs.: As I'm using the timechart command, I can't use "if statement" in search because column names always change.

Code block i'm allowed to post!

| timechart span=1mon count by "Secao" limit=0 usenull=f useother=f cont=false 
| eval mes=strftime(_time,"%B %Y") 
| fields - _time span _spandays 
| transpose 0 header_field=mes column_name="Secao" 
| eval Secao=if(Secao="NULL","Other",Secao) 
| eval Departamento=if(Departamento="NULL","Other",Departamento) 
| eval Equipe=if(Equipe="NULL","Other",Equipe) 
| addtotals
| replace "0" with " "

Before replace:
alt text

After replace:

alt text

0 Karma
1 Solution

ppatrikfr
Path Finder

I solved my own problem by using a simple CSS style. I don't know if It's the right way but it works.
If you have any other solution, i'll be glad to hear and discuss about. Tks

  <panel>
          <html depends="$alwaysHideCSS$">
             <style>
                   #table_to_change .table th, .table td {
                        text-align: right!important;
                    }
             </style>
         </html>
          <table>
            <search id="table_to_change" base="base">
              <query> "Your query goes here :)" </query>
            </search>
            <option name="count">50</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">none</option>
            <option name="rowNumbers">false</option>
          </table>
        </panel>

View solution in original post

0 Karma

ppatrikfr
Path Finder

I solved my own problem by using a simple CSS style. I don't know if It's the right way but it works.
If you have any other solution, i'll be glad to hear and discuss about. Tks

  <panel>
          <html depends="$alwaysHideCSS$">
             <style>
                   #table_to_change .table th, .table td {
                        text-align: right!important;
                    }
             </style>
         </html>
          <table>
            <search id="table_to_change" base="base">
              <query> "Your query goes here :)" </query>
            </search>
            <option name="count">50</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">none</option>
            <option name="rowNumbers">false</option>
          </table>
        </panel>
0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...