Splunk Search

How do I list value in the table as I want order to be?

karu0711
Communicator

I want to be the order I list below?

Very High 

High 

Medium

Low

Very Low 

Info

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Assign each value a number then sort numerically.

| eval sorter = case(level="Very High", 6, level="High", 5, 
                     level="Medium", 4, level="Low", 3, 
                     level="Very Low", 2, level="Info", 1, 
                     1==1, 0)
| sort - sorter
| fields - sorter
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Assign each value a number then sort numerically.

| eval sorter = case(level="Very High", 6, level="High", 5, 
                     level="Medium", 4, level="Low", 3, 
                     level="Very Low", 2, level="Info", 1, 
                     1==1, 0)
| sort - sorter
| fields - sorter
---
If this reply helps you, Karma would be appreciated.

PaulPanther
Motivator

Some more information would be helpful next time but anyway if you have a field with the mentioned values. You can do it as follow:

 

|  eval status=case(criticality="Very High", 6,criticality=="High",5,criticality=Medium,4,criticality="Low",3,criticality="Very Low",2,criticality="Info",1)
| table data, criticality, status
| sort -status
| fields - status

 

 

 

 

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...