I just stumbled on this looking for something else,  and wanted to say you can dynamically colour both the background and the major value:    "visualizations": { "viz_UVeH0JP5": { "type": "splunk.singlevalue", "dataSources": { "primary": "ds_VyZ1EWbM" }, "options": { "majorColor": "> majorValue | matchValue(majorColorEditorConfig)", "backgroundColor": "> majorValue | matchValue(backgroungColorEditorConfig)" }, "context": { "majorColorEditorConfig": [ { "match": "NotDropped", "value": "#2f8811" }, { "match": "Dropped", "value": "#ffffff" } ], "backgroundColorEditorConfig": [ { "match": "NotDropped", "value": "#000000" }, { "match": "Dropped", "value": "#2f8811" } ] } },   You probably can't do it though the UI, though. I rarely use it, so I'm not sure.  ... View more

I don't think I understand what you're trying to do. $Beta status:result._statusNumber$ is a token set by your search, "Beta status", and therefore has no default value. The screenshot you've shown is for setting tokens when users click on a visualisation. The two things are not related, really, other than how they are used in source code.  What issue are you trying to solve, exactly? If the token isn't working, have you made sure you've checked the "Access search results or metadata" box in the data source config?  ... View more

@KyleMika Heya!  This works for me, at least as I understand what you are trying to do. This is the URL (anonymised) for a dashboard I'm using:  https://xxxxx.splunkcloud.com/en-US/app/<app_name>/<dashboard>?form.LHN=LHN&form.dd_qw5k3GKd=*&form.filter=age&form.l1=*&form.l2=*&form.l3=*&form.rm=*&form.tok_asset_name=*&form.tok_rm=CORE&form.tok_specialty=*&form.tok_tier=*&form.tok_test=nope The last input is in the canvas, the rest are above. All are successfully reproduced if I share it.  Can you share the URL that you are seeing/sharing with others?  ... View more

Thanks for that! I need to find some time to invest in this.  ... View more

I'm not entirely sure if I understand what you're asking for, but it sounds like this might be resolved by defining more fields? eg: | eval status_{http_status}=http_status | timechart count(status_*) as * by endpoint Would that do the trick?  ... View more