topic Re: How to sort severity in search? in Splunk Enterprise

How to sort severity in search?

Ropermark — Mon, 20 Aug 2018 14:22:39 GMT

Hello all,

I am very new to Splunk and I am looking to sort by the following command:

index=server-farm Risk=Critical OR Risk=High OR Risk=Medium OR Risk=Low | chart count by index, Risk | addtotals

But the problem is when I see the result I see in the following order:

index  - Critical - High - Low - Medium - Total

I want to sort that in:

Index - Critical - High - Medium - Total

Could someone please help me how to sort that.

Thanks in advance.

Re: How to sort severity in search?

tomawest — Mon, 20 Aug 2018 15:56:44 GMT

I suspect someone may be able to come up with a cleaner way, however this is the kind of approach I have taken in the past to this kind of issue.

index=server-farm Risk=Critical OR Risk=High OR Risk=Medium OR Risk=Low | eval Risk=if(Risk="Critical","1:". Risk,if(Risk="High","2:". Risk,if(Risk="Medium","3:". Risk,"4:". Risk))) | chart count by index, Risk | rex field=Risk "[0-9]+:(?.+)" | addtotals

Re: How to sort severity in search?

niketn — Mon, 20 Aug 2018 16:06:50 GMT

@Ropermark you can try out the following SPL

 index=server-farm Risk=Critical OR Risk=High OR Risk=Medium OR Risk=Low 
| chart count by index, Risk
| rename Low as "1.Low",Medium as "2.Medium",High as "3.High",Critical as "4.Critical"
| table index 1.* 2.* 3.* 4.*
| rename 1.* as *, 2.* as *, 3.* as *, 4.* as *
| addtotals

Following is a run anywhere search example:

| makeresults
| eval data="Risk=Critical,index=a OR Risk=High,index=a OR Risk=Medium,index=b OR Risk=Low,index=b OR Risk=Critical,index=b OR Risk=High,index=b OR Risk=Medium,index=b OR Risk=Low,index=b"
| makemv data delim=" OR "
| mvexpand data
| rename data as _raw
| KV
| chart count by index, Risk
| rename Low as "1.Low",Medium as "2.Medium",High as "3.High",Critical as "4.Critical"
| table index 1.* 2.* 3.* 4.*
| rename 1.* as *, 2.* as *, 3.* as *, 4.* as *
| addtotals

Re: How to sort severity in search?

Ropermark — Fri, 24 Aug 2018 14:20:08 GMT

Hello thanks for the reply..
But the problem is always same.

the result query answer is

i want low after medium, in this way my graph will be what i want.

thanks for your help

Re: How to sort severity in search?

niketn — Sat, 25 Aug 2018 18:36:47 GMT

Then use rename "1.Medium", "2.Low"... in the above SPL.