This is what I used and after applying the results just highlights the entire mv field in red <format type="color"> <colorPalette type="expression"> case (match(value,"Large Effect"), "#ff0000"...
See more...
This is what I used and after applying the results just highlights the entire mv field in red <format type="color"> <colorPalette type="expression"> case (match(value,"Large Effect"), "#ff0000",match(value,"Medium Effect"), "#ffff00",match(value,"Small Effect"),"#00ff00",true(),"#ffffff")</colorPalette> </format> looking for Small effect -> Green Medium effect -> Orange and Large effect -> Red Continuing from this search: @ITWhisperer https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-csv-data-fields-message-data-into-fields/m-p/695151#M236406