You can use match() to scan all of _raw on every event. If you look for "WARN" then it will find "WARNING". If I was doing this I would instead give my sourcetype/search a field called log_level (in case _raw is long). <dashboard> <label>test_conditional_color</label> <row> <panel> <html> <style> #tableRowColorWithoutJS table tbody td div.multivalue-subcell[data-mv-index="1"]{ display: none; } </style> </html> <table id="tableRowColorWithoutJS"> <title>We can color columnA based on whichever Log Level we see in columnB </title> <search> <query> index=_internal log_level!="INFO" | fields index sourcetype host _raw | streamstats count as id | table id a_new_field* * | eval hex_color = case(match(_raw,"ERROR"),"red", match(_raw,"INFO"),"green", true(),"amber") | foreach * hex_color [| eval "<<FIELD>>"='<<FIELD>>'."|".hex_color] | foreach * [| eval "<<FIELD>>"=split('<<FIELD>>',"|")] | fields index sourcetype host _raw </query> <earliest>-1h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <format type="color" field="host"> <colorPalette type="expression">case (match(value,"red"),"#DC4E41", match(value,"green"),"#53a051", true(),"#f4a747")</colorPalette> </format> </table> </panel> </row> </dashboard>
... View more