Using the example below, how do I change the "totalbytes" output to Red when one of the fields exceeds 1000? For example, if an output is something like (see below), how can I make the top
entry Red, while the rest remains unchanged?
1402 10.0.0.1
200 192.168.1.1
125 10.1.1.2
etc...
Thanks,
index=generic
| stats sum(bytes) as totalbytes by dest_ip
| eval totalbytes=round(totalbytes/1024/1024)
| sort -totalbytes
| head 10
| table totalbytes, dest_ip
This question has been asked/answered a number of different ways in the past. A couple of explainations/solutions can be found here
http://answers.splunk.com/answers/83206/color-in-a-table-based-on-values
and here
http://answers.splunk.com/answers/8775/configure-colour-coded-results-by-default
This question has been asked/answered a number of different ways in the past. A couple of explainations/solutions can be found here
http://answers.splunk.com/answers/83206/color-in-a-table-based-on-values
and here
http://answers.splunk.com/answers/8775/configure-colour-coded-results-by-default