This is what i ended up doing. Using the Single Value visualization. index=windows source=service host=servername* Name=service_name* earliest=-5m State="Running" | eval Site=if(host="server1", "Town1", if(host="server2","Town2","Down")) | eval range=if(Site=="Town1", "high", if(Site=="Town2","guarded","severe")) | dedup Site Then editing the xml as follows: <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="colorMode">block</option> <option name="field">Site</option> <option name="charting.fieldColors"></option> </single> </panel> ... View more