Here is my query:
<table id="tableColorFinalRowBasedOnData7">
<search>
<query>index="xxxx" source=service (DisplayName="a*" OR DisplayName="b*") host IN (abc xyz) earliest=-60m
| dedup host Name
| table host Name StartMode State | sort Name
| eval color=case(State="Stopped","#880808",State="Running","#008000")
| foreach host Name StartMode State[eval <<FIELD>>=mvappend('<<FIELD>>',color)]
| fields - color</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<format type="color">
<colorPalette type="map">{"Manual":#FF7F50}</colorPalette>
</format>
<format type="color" field="host">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="Name">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="StartMode">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
</table>
Service running is getting displayed as green and stopped as red but startmode manual is not setting to orange.
| eval color=case(State="Stopped","#880808",State="Running","#008000",State="Manual","#FF7F50")
@ITWhisperer I already tried this and it doesnot work because i have StartMode as Manual and State as Stopped.. So the entire cell is displayed as RED. But i need Manual to be in Orange.
| eval color=case(State="Stopped","#880808",State="Running","#008000")
| foreach host Name State[eval <<FIELD>>=mvappend('<<FIELD>>',color)]
| eval StartMode=if(StartMode="Manual",mvappend(StartMode,"#FF7F50"),StartMode)