https://community.splunk.com/t5/Dashboards-Visualizations/Change-Search-Results-Color/m-p/65364#M3446 <P>Using the example below, how do I change the "totalbytes" output to Red when one of the fields exceeds 1000? For example, if an output is something like (see below), how can I make the top<BR /> entry Red, while the rest remains unchanged?</P> <P>1402 10.0.0.1<BR /> 200 192.168.1.1<BR /> 125 10.1.1.2<BR /> etc...</P> <P>Thanks,</P> <P>index=generic<BR /> | stats sum(bytes) as totalbytes by dest_ip<BR /> | eval totalbytes=round(totalbytes/1024/1024)<BR /> | sort -totalbytes<BR /> | head 10<BR /> | table totalbytes, dest_ip</P> Mon, 28 Sep 2020 14:47:33 GMT albyva 2020-09-28T14:47:33Z https://community.splunk.com/t5/Dashboards-Visualizations/Change-Search-Results-Color/m-p/65364#M3446 <P>Using the example below, how do I change the "totalbytes" output to Red when one of the fields exceeds 1000? For example, if an output is something like (see below), how can I make the top<BR /> entry Red, while the rest remains unchanged?</P> <P>1402 10.0.0.1<BR /> 200 192.168.1.1<BR /> 125 10.1.1.2<BR /> etc...</P> <P>Thanks,</P> <P>index=generic<BR /> | stats sum(bytes) as totalbytes by dest_ip<BR /> | eval totalbytes=round(totalbytes/1024/1024)<BR /> | sort -totalbytes<BR /> | head 10<BR /> | table totalbytes, dest_ip</P> Mon, 28 Sep 2020 14:47:33 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Change-Search-Results-Color/m-p/65364#M3446 albyva 2020-09-28T14:47:33Z https://community.splunk.com/t5/Dashboards-Visualizations/Change-Search-Results-Color/m-p/65365#M3447 <P>This question has been asked/answered a number of different ways in the past. A couple of explainations/solutions can be found here</P> <P><A href="http://answers.splunk.com/answers/83206/color-in-a-table-based-on-values">http://answers.splunk.com/answers/83206/color-in-a-table-based-on-values</A></P> <P>and here</P> <P><A href="http://answers.splunk.com/answers/8775/configure-colour-coded-results-by-default">http://answers.splunk.com/answers/8775/configure-colour-coded-results-by-default</A></P> Tue, 17 Sep 2013 15:47:41 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Change-Search-Results-Color/m-p/65365#M3447 lukejadamec 2013-09-17T15:47:41Z