I get below result when use Chart count over field-A by Field-B
We can see there are cell with value 0, is there any solution to replace these 0 with SPACE? Thanks.
Over field value | by field value1 | by field value2 | by field value3 | by field value 4 | by field value5 | Total |
Over value 1 | 0 | 0 | 1 | 0 | 0 | 1 |
Over value 2 | 0 | 0 | 0 | 603 | 0 | 603 |
Over value 3 | 0 | 0 | 12 | 0 | 0 | 12 |
Over value 4 | 0 | 0 | 0 | 600 | 0 | 600 |
Sure.
| foreach by* [ eval '<<FIELD>>'=if('<<FIELD>>'=0," ",'<<FIELD>>') ]
Are you sure you don't want an empty string or null value?
Sure.
| foreach by* [ eval '<<FIELD>>'=if('<<FIELD>>'=0," ",'<<FIELD>>') ]
Are you sure you don't want an empty string or null value?
The search only returns data. Formatting is up to your visualization.
Before use foreach command to replace zero with SPACE, I can see the string table data is left-justify and numeric data is right-justify
After "foreach", I can see 7 numeric column data is left-justify and only 1 numeric column data is right-justify.
Understand that, as per the Splunk manual I can see below attribute for table column number format.
<format type="number" field="count"> <option name="precision">3</option> <option name="useThousandSeparators">false</option> <option name="unit">MB</option> <option name="unitPosition">before</option> </format>
If we use table as visualization solution, can we specify how the number justify?
Similarly, I see some table column head/title is left-justify and a few is right-justify.
Is there any solution to align the same justification? Thanks.