I know this is an old message and you probably figured it out by now, but just in case... The "stats" command can turn multiple events into 1 event. You're using list() which will create mv (multi-valued) fields. To illustrate, you started with: status ...
event 1: good ...
event 2: bad ...
event 3: good ...
event 4: bad ... When you do a search like: | stats list(status) as status, ..., you end up with: status
event 1: good
bad
good
bad So the coloring is for 1 "cell", not 4 "cells".
... View more