the below displays first login in the system. If user has no logon information, it should display "No logon found" in Amber color.
When there is no result , it displays as "No logon found". I want to color that value "No logon Found" single value panel
index=XXX sourcetype="XXXX" source="*.log" user=XXXX AAA
| eval Authentication=case(XXXXXX)
| eval CredType=case(XXXX)
| eval ProductType=case(XXX)
| rename xxx As "xxxy"
| eval Time=strftime(_time,"%d %B %Y")
| stats earliest(Time) AS FirstLogin| append
[ stats count
| where count=0
| eval Messge="No data found"]
| fillnull value="No Logon Found" FirstLogin
| fields FirstLogin
