@niketn I tried your solution : it's ok except for the hide multivalue simple XML extension. My dashboard displays the "log_level" values anyway (called "defcon") I'm using Splunk 7.3.3. The dashboard has multiple panels any idea about the reason ? <panel depends="$panel_show100KO$">
<title>Liste 100% KO </title>
<html>
<style>
#tableRowColor100KO table tbody td div.multivalue-subcell[data-mv-index="1"] { display: none; }
</style>
</html>
<table id="tableRowColor100KO">
<search>
<progress>
<condition match="'job.resultCount' > 0">
<set token="panel_show100KO">true</set>
</condition>
<condition>
<unset token="panel_show100KO"></unset>
</condition>
</progress>
<query>index="XXXXXXXX" host="XXXXXXXX" (...) | eval NbKO=total-KOMetier-NbOK,defcon=case(NbKO < 10,"5",NbKO < 20,"4",NbKO < 30,"3",NbKO < 40,"2",true(),"1") | table defcon,categorie,numero_amc,libelle_amc,id_ws,end_point,total,NbKO | uniq | where total=NbKO | sort -total | foreach * [ eval <<FIELD>>='<<FIELD>>'."|".defcon] | foreach * [ eval <<FIELD>>=split('<<FIELD>>',"|") ]</query>
<earliest>-8h@m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<refresh>60s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="defcon">
<colorPalette type="expression">case(match(value,"1"),"0x555",match(value,"2"),"0xdc4e41",match(value,"3"),"0xf1813f",match(value,"4"),"0xf8be34",match(value,"5"),"0x53a051",true(),white)</colorPalette>
</format>
<format type="color" field="categorie">
<colorPalette type="expression">case(match(value,"1"),"0x555",match(value,"2"),"0xdc4e41",match(value,"3"),"0xf1813f",match(value,"4"),"0xf8be34",match(value,"5"),"0x53a051",true(),white)</colorPalette>
</format>
<format type="color" field="numero_amc">
<colorPalette type="expression">case(match(value,"1"),"0x555",match(value,"2"),"0xdc4e41",match(value,"3"),"0xf1813f",match(value,"4"),"0xf8be34",match(value,"5"),"0x53a051",true(),white)</colorPalette>
</format>
<format type="color" field="libelle_amc">
<colorPalette type="expression">case(match(value,"1"),"0x555",match(value,"2"),"0xdc4e41",match(value,"3"),"0xf1813f",match(value,"4"),"0xf8be34",match(value,"5"),"0x53a051",true(),white)</colorPalette>
</format>
<format type="color" field="id_ws">
<colorPalette type="expression">case(true(),"#d234eb")</colorPalette>
</format>
<format type="color" field="end_point">
<colorPalette type="expression">case(true(),"#d234eb")</colorPalette>
</format>
<format type="color" field="total">
<colorPalette type="expression">case(true(),"#d234eb")</colorPalette>
</format>
<format type="color" field="NbKO">
<colorPalette type="expression">case(true(),"#d234eb")</colorPalette>
</format>
</table>
</panel>
... View more
