@woodcock I took your suggestion and started from scratch, removed the results sorting too and tried both
| stats count by severity
and
| chart count by severity
to see if there would be any difference. Unfortunately neither made any change. I kept digging and found a reference to using transpose to fix it. So I added the following to the end of my query
| stats count by severity
| eval sortingSequence=case(severity="critical", 1, severity="high", 2, severity="medium", 3, severity="low", 4, severity="unknown", 5, 1=1, 0)
| sort sortingSequence | fields - sortingSequence | transpose 0 header_field="severity" column_name="severity"
Once I added the tranpose it would then recognise the values for the series and color them correctly. I do have a rogue "count" label on the Y axis instead of "high,medium,low" that now though that I can't figure out how to get rid of but I'll accept it.
... View more