splunk2.xml

<row>
    <single>
      <title>Health status</title>
      <searchString>index="surveillance-status" sourcetype="drip" | sort _time | eval range=case(status == "OK", "low", status == "WARN", "guarded", status == "ERROR", "severe")</searchString>
      <earliestTime>rt-6m</earliestTime>
      <latestTime>rt</latestTime>
      <option name="classField">range</option>
      <option name="field">status</option>
      <option name="linkView">search</option>
    </single>
</row>