I have a table that shows the number of logs by severity over each host. I want to be able to rearrange the severity columns into a specific order but can't figure out how. I tried using custom sort field via eval but didn't seem to work.
Current SPL
index=foo sourcetype=logs
| chart count over server by severity
Current Table Order
server major info critical minor
serverA 5 10 8 6
serverB 22 5 13 9
Desired Table Order
server critical major minor info
serverA 8 5 6 10
serverB 13 22 9 5
use table command to re arrange table header:
| table server critical major minor info
use table command to re arrange table header:
| table server critical major minor info