Something like this??
<dashboard> <label>OverallHealthStatus</label> <row> <panel> <table> <search> <query>index=_internal ERROR | stats count by sourcetype | eval Status=case(count>100,"RED", count>70,"YELLOW", count<50,"GREEN",1=1,"BROWN")</query> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> </table> </panel> </row> </dashboard>
Hi @Somesoni2, thanks for your reply. But in my case I need to hide count and source type details in front. Just for One value[which should run in background] and I need to show the color alone in front end. Like text as GREEN,RED[or X symbol] ,YELLOW
Please see the attachment:
Also check out the following app if you want to perform any table customization based on this status field (cell highlighting, row highlighting, icon sets, etc).
Splunk 6.x Dashboard Examples