Hi @mmwells
Can you please share the error you are getting?.
also please find following XML code i found it in community last time.
using this create a dashboard , and update the query and clour as needed
sample output
<dashboard version="1.1">
<label>Colour entire row based on value</label>
<row>
<panel>
<html depends="$alwaysHideHTMLCSSPanel$">
<style>
#tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
<table id="tableColorFinalRowBasedOnData">
<search>
<query>index=_internal source="C:\\Program Files\\Splunk\\var\\log\\splunk\\splunkd.log"
| stats count by component log_level
| eval color=case(log_level="INFO","#00FF00",log_level="WARN","#FFBF00",log_level="ERROR","#FF0000")
| foreach component log_level count [ eval <<FIELD>>=mvappend('<<FIELD>>',color)]
| fields - color</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="log_level">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="component">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="count">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
----
Regards,
Sanjay Reddy
----
If this reply helps you, Karma would be appreciated
