topic Re: Sorting stats 'list' results in a certain order? in Splunk Search

Sorting stats 'list' results in a certain order?

mrgibbon — Wed, 09 Aug 2017 22:43:05 GMT

Hi All, Im working with some vulnerability data and I'm wondering if I can sort the list I have of different vulnerability ratings the way I want it to look. So far I have come up empty on ideas.
At the moment the data is being sorted alphabetically and looks like this:

Critical Severity   
High Severity
Informative 
Low Severity
Medium Severity

I'd like it to look like this:

Critical Severity   
High Severity
Medium Severity
Low Severity
Informative

Possible?
Thanks!

Re: Sorting stats 'list' results in a certain order?

woodcock — Wed, 09 Aug 2017 23:34:17 GMT

At the point that you have something like this:

| stats values(severity) AS severity BY host

Add this after it:

| rex field=severity mode=sed "s/(Critical Severity)/5:\1/ s/(High Severity)/4:\1/ s/(Medium Severity)/3:\1/ s/(Low Severity)/2:\1/ s/(Informative)/1:\1/"

Then do it again to cause it to be resorted:

| stats values(severity) AS severity BY host

You could do this before you do the stats but then you are changing millions of events instead of a few.
P.S. Yes, this is backwards from your perfect desire but should be close enough. If you REALLY need it the other way, then you can do this instead:

| rex field=severity mode=sed "s/(Critical Severity)/    \1/ s/(High Severity)/   \1/ s/(Medium Severity)/  \1/ s/(Low Severity)/ \1/"

Re: Sorting stats 'list' results in a certain order?

mrgibbon — Thu, 10 Aug 2017 04:12:08 GMT

Wonderful!
This worked a treat:

| eval sevdesc='severity.description'
| stats count by "Custom Tag", sevdesc 
| rex field=sevdesc mode=sed "s/(Critical Severity)/    \1/ s/(High Severity)/   \1/ s/(Medium Severity)/  \1/ s/(Low Severity)/ \1/"
| stats list(count), values(sevdesc) by "Custom Tag" 
| sort values(sevdesc), -list(count) 
| rename "Custom Tag" AS Application list(count) AS Count values(sevdesc) AS Severity

Thanks!