Here is my query: <table id="tableColorFinalRowBasedOnData7"> <search> <query>index="xxxx" source=service (DisplayName="a*" OR DisplayName="b*") host IN (abc xyz) earliest=-60m | dedup host Nam...
See more...
Here is my query: <table id="tableColorFinalRowBasedOnData7"> <search> <query>index="xxxx" source=service (DisplayName="a*" OR DisplayName="b*") host IN (abc xyz) earliest=-60m | dedup host Name | table host Name StartMode State | sort Name | eval color=case(State="Stopped","#880808",State="Running","#008000") | foreach host Name StartMode State[eval <<FIELD>>=mvappend('<<FIELD>>',color)] | fields - color</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <format type="color"> <colorPalette type="map">{"Manual":#FF7F50}</colorPalette> </format> <format type="color" field="host"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> <format type="color" field="Name"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> <format type="color" field="StartMode"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> <format type="color" field="State"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> </table> Service running is getting displayed as green and stopped as red but startmode manual is not setting to orange.