Splunk Search

How do I list value in the table as I want order to be?

karu0711
Communicator

I want to be the order I list below?

Very High 

High 

Medium

Low

Very Low 

Info

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Assign each value a number then sort numerically.

| eval sorter = case(level="Very High", 6, level="High", 5, 
                     level="Medium", 4, level="Low", 3, 
                     level="Very Low", 2, level="Info", 1, 
                     1==1, 0)
| sort - sorter
| fields - sorter
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Assign each value a number then sort numerically.

| eval sorter = case(level="Very High", 6, level="High", 5, 
                     level="Medium", 4, level="Low", 3, 
                     level="Very Low", 2, level="Info", 1, 
                     1==1, 0)
| sort - sorter
| fields - sorter
---
If this reply helps you, Karma would be appreciated.

PaulPanther
Motivator

Some more information would be helpful next time but anyway if you have a field with the mentioned values. You can do it as follow:

 

|  eval status=case(criticality="Very High", 6,criticality=="High",5,criticality=Medium,4,criticality="Low",3,criticality="Very Low",2,criticality="Info",1)
| table data, criticality, status
| sort -status
| fields - status

 

 

 

 

Get Updates on the Splunk Community!

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...