my query is <dashboard version="1.1"> <label>CCEcolour</label> <row> <panel> <table> <search> <query>index=*** source=service Name IN (*abc* *def* *ghi* *jkl* *mno*) host IN (xyz) earliest=-60m | dedup host Name | table Name Status State | sort Name | eval color=case(Status="Stopped","HIGH",Status="Running","LOW") | foreach Name Status State [ eval <<FIELD>>=mvappend('<<FIELD>>',color)] | fields - color </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="Name"> <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"HIGH"),"#53A051")</colorPalette> </format> <format type="color" field="Status"> <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"HIGH"),"#53A051")</colorPalette> </format> <format type="color" field="State"> <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"HIGH"),"#53A051")</colorPalette> </format> </table> </panel> </row> </dashboard>
For the below result where i have "State" as "Stopped" , the entire row should be in Red Color including corresponding Status and Name.
Name
Status
State
abc
OK
Running
def
OK
Running
hij
OK
Stopped
klm
OK
Running
nop
OK
Running
... View more