@mayurr98 ...How do we change the field="field_value" if there like 50 values ..can we use  like wild character like field="host*" ? <format type="color" field="field_value"> <colorPalette type="expression">if (like(value,"%online%"),"#FF5733","#247bc1")</colorPalette> </format>    ... View more

This was incredibly useful. Thank you! ... View more

Hello, I have the same need ( comparing a multivalued numercial field with a single value ) but without using the command mvexpand. is there any other solution ? ... View more

Pasting this answer into a new dashboard (Splunk Enterprise 8.02) produces: " Search is waiting for input..." for about a minute a list of events rather than a table intended as a result Has something changed in Splunk 8 that this no longer works? ... View more

This is really clever! Thank you! ... View more