the below displays first login in the system. If user has no logon information, it should display "No logon found" in Amber color. When there is no result , it displays as "No logon found". I want to color that value "No logon Found" single value panel index=XXX sourcetype="XXXX" source="*.log" user=XXXX AAA | eval Authentication=case(XXXXXX) | eval CredType=case(XXXX) | eval ProductType=case(XXX) | rename xxx As "xxxy" | eval Time=strftime(_time,"%d %B %Y") | stats earliest(Time) AS FirstLogin| append [ stats count | where count=0 | eval Messge="No data found"] | fillnull value="No Logon Found" FirstLogin | fields FirstLogin
... View more