It was worked to me! Thanks a lot! 😄 ... View more

Set up transforms.conf as described in the reference. First, extract the time field with REGEX and then set INGEST_EVAL. For eval, you can use the same one as in SPL. ... View more

I believe this can be helpful to you | makeresults | eval data="14/01/2020 10:00:00,first;13/01/2020 11:00:00,second;13/01/2020 12:00:00,third;13/01/2020 13:00:00,forth;" | makemv data delim=";" | mvexpand data | makemv data delim="," | eval timefield=mvindex(data,0),header=mvindex(data,1) | table timefield header | streamstats min(timefield) as StartTime max(timefield) as EndTime | tail 1       ... View more

If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

Hi @adonio , Thanks for your help in search anywhere. Thanks, Ankush ... View more

Perfect now. Thanks a lot @niketnilay 🙂 ... View more

@askkawalkar Glad it worked! Thanks for an interesting challenge as this is the first question I noticed on Splunk Answers for Row based Table Cell Color logic . Do Accept one of the answers to mark this question as answered and Up Vote the answers/comments that helped! ... View more

You missed the below part <finalized> <set token="background">$result.background$</set> </finalized> This is where the token value is updated ... View more