Create dashboard to show vmware AlarmStatusChangedEvent until event goes from red to green

[wilcoxj]

I am running index=vmware-taskevent | spath eventClass | search eventClass=AlarmStatusChangedEvent and I want to have my dashboard show only the events that have not changed from red to green.

Here is the raw text:
{"entity": {"entity": {"moid": "host-145895", "type": "HostSystem"}, "name": "cpcdwesx02.na.cintas.com"}, "datacenter": {"datacenter": {"moid": "datacenter-21", "type": "Datacenter"}, "name": "Mason"}, "createdTime": "2020-02-05 21:17:48.765000+00:00", "alarm": {"alarm": {"moid": "alarm-1", "type": "Alarm"}, "name": "Host connection and power state"}, "source": {"entity": {"moid": "group-d1", "type": "Folder"}, "name": "Datacenters"}, "eventClass": "AlarmStatusChangedEvent", "chainId": "-1182388515", "host": {"host": {"moid": "host-145895", "type": "HostSystem"}, "name": "cpcdwesx02.na.cintas.com"}, "to": "green", "computeResource": {"computeResource": {"moid": "domain-s145893", "type": "ComputeResource"}, "name": "cpcdwesx02.na.cintas.com"}, "from": "red", "fullFormattedMessage": "Alarm 'Host connection and power state' on cpcdwesx02.na.cintas.com changed from Red to Green", "userName": "None", "key": "-1182388515"}

[to4kawa]

Sample:

|makeresults
| eval _raw="{\"entity\": {\"entity\": {\"moid\": \"host-145895\", \"type\": \"HostSystem\"}, \"name\": \"cpcdwesx02.na.cintas.com\"}, \"datacenter\": {\"datacenter\": {\"moid\": \"datacenter-21\", \"type\": \"Datacenter\"}, \"name\": \"Mason\"}, \"createdTime\": \"2020-02-05 21:17:48.765000+00:00\", \"alarm\": {\"alarm\": {\"moid\": \"alarm-1\", \"type\": \"Alarm\"}, \"name\": \"Host connection and power state\"}, \"source\": {\"entity\": {\"moid\": \"group-d1\", \"type\": \"Folder\"}, \"name\": \"Datacenters\"}, \"eventClass\": \"AlarmStatusChangedEvent\", \"chainId\": \"-1182388515\", \"host\": {\"host\": {\"moid\": \"host-145895\", \"type\": \"HostSystem\"}, \"name\": \"cpcdwesx02.na.cintas.com\"}, \"to\": \"green\", \"computeResource\": {\"computeResource\": {\"moid\": \"domain-s145893\", \"type\": \"ComputeResource\"}, \"name\": \"cpcdwesx02.na.cintas.com\"}, \"from\": \"red\", \"fullFormattedMessage\": \"Alarm 'Host connection and power state' on cpcdwesx02.na.cintas.com changed from Red to Green\", \"userName\": \"None\", \"key\": \"-1182388515\"}"
| spath createdTime
| spath eventClass
| spath from
| spath to
| table createdTime eventClass from to

query:

index=vmware-taskevent "AlarmStatusChangedEvent" NOT "changed from Red to Green"

dashboard:
As you like.