I have a table that shows the number of logs by severity over each host. I want to be able to rearrange the severity columns into a specific order but can't figure out how. I tried using custom sort field via eval but didn't seem to work.
Current SPL
index=foo sourcetype=logs
| chart count over server by severity
Current Table Order
server   major   info   critical    minor
serverA   5       10       8          6
serverB   22       5       13         9
Desired Table Order
server   critical  major   minor  info
serverA   8         5       6      10
serverB   13        22      9       5
 
					
				
		
 
		
		
		
		
		
	
			
		
		
			
					
		use table command to re arrange table header:
| table server critical major minor info
 
					
				
		
 
		
		
		
		
		
	
			
		
		
			
					
		use table command to re arrange table header:
| table server critical major minor info
