topic Re: Splunk email csv column order not being the same as search in Splunk Enterprise

Why is Splunk email csv column order not being the same as search?

Tim_Accenture — Fri, 14 Apr 2023 18:46:26 GMT

Recently we discovered that our Splunk sendemail command in combination with the sendcsv option is no longer using the same order for the columns as the search itself. We suspect that that has been broken since we upgraded from 8.x to 9.0.3. We've tried messing around with the width_sort_columns, but this hasn't produced the results we're looking for. Has anyone else experienced the same issues and maybe already found a solution?

Re: Splunk email csv column order not being the same as search

woodcock — Fri, 14 Apr 2023 18:17:56 GMT

Be specific here.

Re: Why is Splunk email csv column order not being the same as search?

Tim_Accenture — Mon, 17 Apr 2023 05:45:22 GMT

When using the | sendemail command and setting 'sendcsv=true' in our old situation the attached .csv file would have the same column order of our search. It appears that since upgrading to 9.0.3 from 8.1.x, we can no longer influence the column order in our .csv file.

An example:

Our search would be

| ....
| table a b c
| sendemail to=... sendcsv=true

Which in our old situation would keep the column order of our | table command. Now it would be 'b c a' in the .csv file attached in the mail instead of 'a b c'. Whatever order for the table we set in our search no longer influences the .csv file.

Hope this clarifies it a bit.

Re: Why is Splunk email csv column order not being the same as search?

woodcock — Mon, 17 Apr 2023 21:20:21 GMT

Could be this:

width_sort_columnsSyntax: width_sort_columns=<boolean>Description: This is only valid for plain text emails. Specifies whether the columns should be sorted by their width.Default: true

From here:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sendemail

Re: Why is Splunk email csv column order not being the same as search?

Tim_Accenture — Fri, 21 Apr 2023 13:27:21 GMT

Thanks for the suggestion. We tried that already and that is not it.

still gives the following since version 9.0.x.

I'm starting to think this is just a bug. I have been able to confirm this behavior on 2 separate Splunk environments already since we upgraded them from version 8 to 9.

Re: Why is Splunk email csv column order not being the same as search?

woodcock — Fri, 21 Apr 2023 13:52:18 GMT

Open a support ticket but ALSO go to the documentation page that I listed and go to the bottom and send them feedback and point to this answers post. They dox team is GREAT and they will get to the bottom of it.