How to sort severity in search?

[Ropermark]

Hello all,

I am very new to Splunk and I am looking to sort by the following command:

index=server-farm Risk=Critical OR Risk=High OR Risk=Medium OR Risk=Low | chart count by index, Risk | addtotals

But the problem is when I see the result I see in the following order:

index  - Critical - High - Low - Medium - Total

I want to sort that in:

Index - Critical - High - Medium - Total 

Could someone please help me how to sort that.

Thanks in advance.

[niketn]

@Ropermark you can try out the following SPL

 index=server-farm Risk=Critical OR Risk=High OR Risk=Medium OR Risk=Low 
| chart count by index, Risk
| rename Low as "1.Low",Medium as "2.Medium",High as "3.High",Critical as "4.Critical"
| table index 1.* 2.* 3.* 4.*
| rename 1.* as *, 2.* as *, 3.* as *, 4.* as *
| addtotals

Following is a run anywhere search example:

| makeresults
| eval data="Risk=Critical,index=a OR Risk=High,index=a OR Risk=Medium,index=b OR Risk=Low,index=b OR Risk=Critical,index=b OR Risk=High,index=b OR Risk=Medium,index=b OR Risk=Low,index=b"
| makemv data delim=" OR "
| mvexpand data
| rename data as _raw
| KV
| chart count by index, Risk
| rename Low as "1.Low",Medium as "2.Medium",High as "3.High",Critical as "4.Critical"
| table index 1.* 2.* 3.* 4.*
| rename 1.* as *, 2.* as *, 3.* as *, 4.* as *
| addtotals

[Ropermark]

Hello thanks for the reply..
But the problem is always same.

the result query answer is

Index | Critial | High | Low | Medium | Total

i want low after medium, in this way my graph will be what i want.

thanks for your help

[niketn]

Then use rename "1.Medium", "2.Low"... in the above SPL.

[tomawest]

I suspect someone may be able to come up with a cleaner way, however this is the kind of approach I have taken in the past to this kind of issue.

index=server-farm Risk=Critical OR Risk=High OR Risk=Medium OR Risk=Low |
eval Risk=if(Risk="Critical","1:". Risk,if(Risk="High","2:". Risk,if(Risk="Medium","3:". Risk,"4:". Risk))) |
chart count by index, Risk |
rex field=Risk "[0-9]+:(?.+)" |
addtotals