index="_internal" | timechart span=15m count(name) as name | eval Status=if(name>1500, "RED", if(name>100,"AMBER","GREEN"))
| eval user="NA"
| table _time, user, Status
This is a sample query i used, need to show green color circle when status is green and red for red and so on. Any help?
Thanks,
Sunith.
↧