Solved: Why am I losing table formatting when using the re...

ppatrikfr · ‎10-23-2018

Hello,

I have a search that i want to take zeros off of. But, when i do it with replace, it loses its table formatting. Can anyone help me?

Obs.: As I'm using the timechart command, I can't use "if statement" in search because column names always change.

Code block i'm allowed to post!

| timechart span=1mon count by "Secao" limit=0 usenull=f useother=f cont=false 
| eval mes=strftime(_time,"%B %Y") 
| fields - _time span _spandays 
| transpose 0 header_field=mes column_name="Secao" 
| eval Secao=if(Secao="NULL","Other",Secao) 
| eval Departamento=if(Departamento="NULL","Other",Departamento) 
| eval Equipe=if(Equipe="NULL","Other",Equipe) 
| addtotals
| replace "0" with " "

Before replace:

After replace:

ppatrikfr · ‎10-23-2018

I solved my own problem by using a simple CSS style. I don't know if It's the right way but it works.
If you have any other solution, i'll be glad to hear and discuss about. Tks

  <panel>
          <html depends="$alwaysHideCSS$">
             <style>
                   #table_to_change .table th, .table td {
                        text-align: right!important;
                    }
             </style>
         </html>
          <table>
            <search id="table_to_change" base="base">
              <query> "Your query goes here :)" </query>
            </search>
            <option name="count">50</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">none</option>
            <option name="rowNumbers">false</option>
          </table>
        </panel>

View solution in original post

ppatrikfr · ‎10-23-2018

I solved my own problem by using a simple CSS style. I don't know if It's the right way but it works.
If you have any other solution, i'll be glad to hear and discuss about. Tks

  <panel>
          <html depends="$alwaysHideCSS$">
             <style>
                   #table_to_change .table th, .table td {
                        text-align: right!important;
                    }
             </style>
         </html>
          <table>
            <search id="table_to_change" base="base">
              <query> "Your query goes here :)" </query>
            </search>
            <option name="count">50</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">none</option>
            <option name="rowNumbers">false</option>
          </table>
        </panel>

Why am I losing table formatting when using the replace command?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Join the Conversation