How can I color fields in a table based on date?

[digital_alchemy]

Requirements:
I have a dashboard to display a table containing a list of my sourcetypes with the first date last date and last updated dates. Since we have well over 1000 sourcetypes I would like to be able to highlight either the field or entire row based on the last updated field in order to be able to quickly see if we have lost a sourcetype.

So basically if the last updated date is greater than 1 day old highlight the row/field red.

I've read the previous solutions to similar situations, but unfortunately I do not have access to modify any of the Splunk configuration settings or files.

Current Search:

| metadata type=sourcetypes index=* | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c")

Example Results:

Count     First Event     Last Event     Last Update     Sourcetype     Type
xxx       date/time       date/time      date/time       McAfee:epo     sourcetype

Any ideas?

[lguinn2 · Accepted solution]

Here is an idea, although it is not exactly what you asked for:

| metadata type=sourcetypes index=* 
| eval checkDate = relative_time(now(),"-1d@d")
| eval alert = if(lastTime < checkDate,"Alert",null())
| rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" 
| fieldformat Count=tostring(Count, "commas") 
| fieldformat "First Event"=strftime('First Event', "%c") 
| fieldformat "Last Event"=strftime('Last Event', "%c") 
| fieldformat "Last Update"=strftime('Last Update', "%c")

At least this identifies the sourcetypes with potential problems, but it doesn't change the color...

[digital_alchemy]

This method will actually be more useful than my original plan. Thank you.