Change Search Results Color

[albyva]

Using the example below, how do I change the "totalbytes" output to Red when one of the fields exceeds 1000? For example, if an output is something like (see below), how can I make the top
entry Red, while the rest remains unchanged?

1402 10.0.0.1
200 192.168.1.1
125 10.1.1.2
etc...

Thanks,

index=generic
| stats sum(bytes) as totalbytes by dest_ip
| eval totalbytes=round(totalbytes/1024/1024)
| sort -totalbytes
| head 10
| table totalbytes, dest_ip

[lukejadamec · Accepted solution]

This question has been asked/answered a number of different ways in the past. A couple of explainations/solutions can be found here

http://answers.splunk.com/answers/83206/color-in-a-table-based-on-values

and here

http://answers.splunk.com/answers/8775/configure-colour-coded-results-by-default