https://community.splunk.com/t5/Dashboards-Visualizations/Question-about-search/m-p/92316#M5024 <P>Further to Ayns answer, you don't need to do a | search after your searchterms, they are all search terms. Just do a sourcetype=firewall rule=100 drop OR accept | head etc</P> Fri, 06 Jul 2012 13:40:49 GMT Drainy 2012-07-06T13:40:49Z https://community.splunk.com/t5/Dashboards-Visualizations/Question-about-search/m-p/92314#M5022 <P>Hi,</P> <P>I built a search like this</P> <PRE><CODE>sourcetype=firewall rule=100 | search drop OR accept | head 1 </CODE></PRE> <P>This shows my only the last event (drop or accept).</P> <P>Now I want to visualize with a colored single value field. For "drop" it should going red, for accept it should going green.</P> <P>How can I realize that?</P> <P>Thank you very much!</P> <P>Regards</P> Fri, 06 Jul 2012 09:12:35 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Question-about-search/m-p/92314#M5022 nebel 2012-07-06T09:12:35Z https://community.splunk.com/t5/Dashboards-Visualizations/Question-about-search/m-p/92315#M5023 <P>This is covered in the docs: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Developer/AddASingleButton#Set_the_color_of_the_panel">http://docs.splunk.com/Documentation/Splunk/latest/Developer/AddASingleButton#Set_the_color_of_the_panel</A></P> Fri, 06 Jul 2012 12:32:37 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Question-about-search/m-p/92315#M5023 Ayn 2012-07-06T12:32:37Z https://community.splunk.com/t5/Dashboards-Visualizations/Question-about-search/m-p/92316#M5024 <P>Further to Ayns answer, you don't need to do a | search after your searchterms, they are all search terms. Just do a sourcetype=firewall rule=100 drop OR accept | head etc</P> Fri, 06 Jul 2012 13:40:49 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Question-about-search/m-p/92316#M5024 Drainy 2012-07-06T13:40:49Z