could someone help what to modify in bellow search, as i want to display red/green color if the value is True or False
sourcetype="xendesktop:7:machine" MachineName="$MachineName$" | table InMaintenanceMode | rename InMaintenanceMode as Maintenance | replace False with OFF in Maintenance | replace True with ON in Maintenance
Why is there no option for text, same as for numerical values?
@janitka There's lots of comparison operators and navigating which does what can be difficult. Especially since there can often be more than one way to get to an answer. However, you did the right thing and asking for opinions on Splunk Answers.
Use this run anywhere example to see that I can take the text you have given and created an example that results in a Maintenance column with ON and OFF values.