I have the table below and want to reflect the severity of the duration metric by highlighting the entire row
index=...| eval epochtime = strptime(startTime,"%a %m/%d %H:%M %Y")| eval start = strftime(epochtime,"%a %d/%m/%Y %H:%M")| eval duration = tostring(round(now()-epochtime), "duration")| table time user client start duration
Is it possible to highlight or outline the entire row in red if the duration > 08:00
If your dashboard is SimpleXML, you can use CSS - you need to make your fields multi-value fields and use CSS to hide the additional elements.
See this post for an example Re: How to change table cell background color depe... - Splunk Community
View solution in original post