Use multivalue fields with the colour you want and then hide the subcell <row>
<panel depends="$stayhidden$">
<html>
<style>
#tableCellColourTopThree table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
</panel>
<panel>
<table id="tableCellColourTopThree">
<title>Colour Cell by Top 3</title>
<search>
<query>| makeresults
| eval data= "10 1 2 10 20 5 2 12 9 33 1 14 5;11 3 2 5 4 11 2 32 5 44 1 88 2;12 5 4 5 3 6 8 12 9 18 3 7 2;5 6 4 8 2 77 5 45 3 12 5 87 9;6 1 2 11 21 5 2 12 9 34 1 14 5;7 3 2 5 4 12 2 33 5 45 1 89 2;8 5 4 5 3 6 8 13 9 19 3 7 2;9 6 4 8 2 78 5 45 3 12 5 86 9;"
| makemv data delim=";"
| mvexpand data
| makemv data delim=" "
| eval Level=mvindex(data,0), one=mvindex(data,1), two=mvindex(data,2), three=mvindex(data,3), four=mvindex(data,4),five=mvindex(data,5)
| sort 0 -one
| streamstats count as rank
| eval one=if(rank<4,mvappend(one,"RED"),one)
| sort 0 -two
| streamstats count as rank
| eval two=if(rank<4,mvappend(two,"RED"),two)
| sort 0 -three
| streamstats count as rank
| eval three=if(rank<4,mvappend(three,"RED"),three)
| sort 0 -four
| streamstats count as rank
| eval four=if(rank<4,mvappend(four,"RED"),four)
| sort 0 -five
| streamstats count as rank
| eval five=if(rank<4,mvappend(five,"RED"),five)
| sort 0 Level
| table Level one two three four five</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color">
<colorPalette type="expression">case (match(value,"RED"), "#ff0000")</colorPalette>
</format>
</table>
</panel>
</row>
... View more
