https://community.splunk.com/t5/Splunk-Dev/Ordering-of-results-from-Java-SDK-export-search/m-p/76721#M1071 <P>According to <A href="http://dev.splunk.com/view/splunk-java-sdk-how-to/SP-CAAAEHQ">http://dev.splunk.com/view/splunk-java-sdk-how-to/SP-CAAAEHQ</A> "export" searches in the Java SDK return results in the opposite order to most Splunk searches:</P> <UL> <LI><STRONG>Export:</STRONG> An export search is another type of search operation that runs immediately, does not create a job for the search, and starts streaming results immediately. <STRONG>Results are returned in reverse order from other searches―from the oldest results to the newest.</STRONG></LI> </UL> <P>As far as I can see, that last sentence of this bullet point in the documentation is completely wrong. When I run an "export" search using the Java SDK the newest events are returned first. This is reproducible using the example program that comes with the SDK (described at <A href="http://dev.splunk.com/view/SP-CAAAEFF#export">http://dev.splunk.com/view/SP-CAAAEFF#export</A>).</P> <P>It would be brilliant if there <EM>was</EM> a way to export events in ascending time order using the SDK. Has anyone managed to do this?</P> Thu, 03 Jan 2013 11:58:14 GMT dmr195 2013-01-03T11:58:14Z https://community.splunk.com/t5/Splunk-Dev/Ordering-of-results-from-Java-SDK-export-search/m-p/76721#M1071 <P>According to <A href="http://dev.splunk.com/view/splunk-java-sdk-how-to/SP-CAAAEHQ">http://dev.splunk.com/view/splunk-java-sdk-how-to/SP-CAAAEHQ</A> "export" searches in the Java SDK return results in the opposite order to most Splunk searches:</P> <UL> <LI><STRONG>Export:</STRONG> An export search is another type of search operation that runs immediately, does not create a job for the search, and starts streaming results immediately. <STRONG>Results are returned in reverse order from other searches―from the oldest results to the newest.</STRONG></LI> </UL> <P>As far as I can see, that last sentence of this bullet point in the documentation is completely wrong. When I run an "export" search using the Java SDK the newest events are returned first. This is reproducible using the example program that comes with the SDK (described at <A href="http://dev.splunk.com/view/SP-CAAAEFF#export">http://dev.splunk.com/view/SP-CAAAEFF#export</A>).</P> <P>It would be brilliant if there <EM>was</EM> a way to export events in ascending time order using the SDK. Has anyone managed to do this?</P> Thu, 03 Jan 2013 11:58:14 GMT https://community.splunk.com/t5/Splunk-Dev/Ordering-of-results-from-Java-SDK-export-search/m-p/76721#M1071 dmr195 2013-01-03T11:58:14Z https://community.splunk.com/t5/Splunk-Dev/Ordering-of-results-from-Java-SDK-export-search/m-p/76722#M1072 <P>You are right. This seems to be a defect in our documentation. We will get it corrected soon.</P> <P>Thanks for bringing this to our attention.</P> Mon, 11 Mar 2013 23:21:23 GMT https://community.splunk.com/t5/Splunk-Dev/Ordering-of-results-from-Java-SDK-export-search/m-p/76722#M1072 Neeraj_Luthra 2013-03-11T23:21:23Z