my query is  <dashboard version="1.1"> <label>CCEcolour</label> <row> <panel> <table> <search> <query>index=*** source=service Name IN (*abc* *def* *ghi* *jkl* *mno*) host IN (xyz) earliest=-60m | dedup host Name | table Name Status State | sort Name | eval color=case(Status="Stopped","HIGH",Status="Running","LOW") | foreach Name Status State [ eval &lt;&lt;FIELD&gt;&gt;=mvappend('&lt;&lt;FIELD&gt;&gt;',color)] | fields - color </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="Name"> <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"HIGH"),"#53A051")</colorPalette> </format> <format type="color" field="Status"> <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"HIGH"),"#53A051")</colorPalette> </format> <format type="color" field="State"> <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"HIGH"),"#53A051")</colorPalette> </format> </table> </panel> </row> </dashboard>   For the below result where i have "State" as "Stopped" , the entire row should be in Red Color including corresponding Status and Name. Name Status State abc OK Running def OK Running hij OK Stopped klm OK Running nop OK Running ... View more

My output format is 20220129054235.496380-300 I need to convert the value in bold to normal and find the difference of that to now() ie., epoch time.  this will give the uptime in days ... View more

My Query is    index=windows Type=Disk host IN (abc) FileSystem="*" DriveType="*" Name="*" | dedup host, Name | table _time, host, Name | sort host, Name | join type=left host [| search index=perfmon source="Perfmon:CPU" object=Processor collection=CPU counter="% Processor Time" instance=_Total host IN (abc) | convert num(Value) as value num(pctCPU) as value | stats avg(value) as "CPUTrend" max(value) as cpu_utz by host | eval "Max Peak CPU" = round(cpu_utz, 2) | eval "CPUTrend"=round(CPUTrend, 2) | fields - cpu_utz | sort -"Peak CPU" | rename "Max Peak CPU" AS "maxCPUutil" | dedup "maxCPUutil" | table _time, host, "maxCPUutil"] | table host, "maxCPUutil", Name   I have this below output host maxCPUutil Name host                               maxCPUutil       Name abc                                  5.59                       c: abc                                  5.59                       E: abc                                   5.59                       F:   What i want is host                                   maxCPUutil                     Name abc                                          5.59                                     C:                                                                                                  E:                                                                                                  F: ... View more