Something like this??
<dashboard>
<label>OverallHealthStatus</label>
<row>
<panel>
<table>
<search>
<query>index=_internal ERROR | stats count by sourcetype | eval Status=case(count>100,"RED", count>70,"YELLOW", count<50,"GREEN",1=1,"BROWN")</query>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
</table>
</panel>
</row>
</dashboard>
Hi @Somesoni2, thanks for your reply. But in my case I need to hide count and source type details in front. Just for One value[which should run in background] and I need to show the color alone in front end. Like text as GREEN,RED[or X symbol] ,YELLOW
Please see the attachment:
Also check out the following app if you want to perform any table customization based on this status field (cell highlighting, row highlighting, icon sets, etc).
Splunk 6.x Dashboard Examples
https://apps.splunk.com/app/1603/
thnx for your reply