This sort of thing comes up quite regularly - essentially, if you create a multivalue field with the second value being an indicator to the colour you want to use, then you can use CSS to hide the second value but the colorPalette option still works. More details here https://community.splunk.com/t5/Splunk-Search/How-to-color-the-columns-based-on-previous-column-valu...