Splunk Query
index="lamaxu" sourcetype="qmstatus_json" "identifier.dataType"=CHANNEL_STATUS "identifier.dataSource"=MQD2 "attributes.CHANNEL"=QT1.QD2|rename attributes.STATUS as chlstatus|eval status = case(like(chlstatus,"RUNNING"), 0,like(chlstatus,"INACTIVE"), 1, like(chlstatus,"STOPPED"), 1, like(chlstatus,"RETRY"), 2)|table status | rangemap field=status low=0-0 elevated=1-1 severe=2-2 default=severe | eval status=case(status== 0, "TEST3.CHANNEL", status== 1, "TEST3.CHANNEL", status== 2, "TEST3.CHANNEL"
