Hi @ITWhisperer I have received a final change in requirement. Instead of Numbers to be colored , we need the server name to be colored. We are not interested in the count. Can you assist me how to display only colored server names based on SEVERITY.
<query>| search Host=xyz* Severity=*
| stats count count(eval(Severity=="CRITICAL")) as _critical count(eval(Severity=="OK")) as _ok count(eval(Severity=="MEDIUM")) as _medium
| eval _colour=case(_critical>0 AND _medium>0,"red",_critical=0 AND _medium>0,"yellow","_critical=0 AND _medium=0,"green",_critical>0 AND _medium=0, "red")@ITWhisperer The requirement is attached. Right now we are displaying count of the Severity (Critical,OK,Medium) of the hosts but requirement is to display servernames.
Requirement
Present condition
As I said, I don't think it is possible with singles, but you might be able to do something with a table
See if you can adapt this code
<panel depends="$stayhidden$">
<html>
<style>
#hoststatus table tbody{
display:flex;
flex-wrap: wrap;
}
#hoststatus table tbody tr{
margin-right:10px;
margin-bottom:10px;
}
#hoststatus table tbody tr td{
width: 180px;
height: 40px;
text-align: center;
}
#hoststatus table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
</panel>
<panel id="hoststatus">
<table>
<search>
<query>| makeresults count=50
| eval host="Host".mvindex(split("ABCDE",""),random()%4)
| eval count=random()%5
| stats sum(count) as count by host
| eval host=mvappend(host,case(count<20,"GREEN",count<30,"ORANGE",true(),"RED"))
| table host</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color">
<colorPalette type="expression">case (match(value,"RED"), "#ff0000",match(value,"ORANGE"), "#ff8000",match(value,"GREEN"),"#00ff00",true(),"#ffffff")</colorPalette>
</format>
</table>
</panel>
