Assign each value a number then sort numerically.
| eval sorter = case(level="Very High", 6, level="High", 5,
level="Medium", 4, level="Low", 3,
level="Very Low", 2, level="Info", 1,
1==1, 0)
| sort - sorter
| fields - sorter
Assign each value a number then sort numerically.
| eval sorter = case(level="Very High", 6, level="High", 5,
level="Medium", 4, level="Low", 3,
level="Very Low", 2, level="Info", 1,
1==1, 0)
| sort - sorter
| fields - sorter
Some more information would be helpful next time but anyway if you have a field with the mentioned values. You can do it as follow:
| eval status=case(criticality="Very High", 6,criticality=="High",5,criticality=Medium,4,criticality="Low",3,criticality="Very Low",2,criticality="Info",1)
| table data, criticality, status
| sort -status
| fields - status