topic Re: Why does Email Report change column order? in Getting Data In

Why does Email Report change column order?

njones781 — Sun, 07 Jun 2020 00:03:21 GMT

_Time is the column that gets moved from last to first only within the reports csv. Within the Inline results, the search, and a direct csv from the search keeps the columns in the correct order. How can I correct for this current and future reports?

Re: Why does Email Report change column order?

richgalloway — Tue, 02 Jun 2020 17:06:44 GMT

Are you using a table command to set the field order?

Re: Why does Email Report change column order?

njones781 — Tue, 02 Jun 2020 17:12:24 GMT

I was not, my order was being derived from:

|stats count as #Trans by DeptName App Region Tran USERID EmpName ACF2Name _time

Re: Why does Email Report change column order?

richgalloway — Tue, 02 Jun 2020 17:18:10 GMT

Use a table command to specify the order in which to display fields.

Re: Why does Email Report change column order?

njones781 — Tue, 02 Jun 2020 18:13:46 GMT

|table DeptName App Region Tran USERID EmpName ACF2Name _time

Adding in this additional line did not have an impact on the Report csv column order.

Re: Why does Email Report change column order?

richgalloway — Wed, 03 Jun 2020 12:38:07 GMT

You may need to submit a support request.

Re: Why does Email Report change column order?

wyfwa4 — Fri, 11 Sep 2020 11:38:12 GMT

It appears that Splunk detects the "_time" fields and makes a decision that this should be first - I assume as _time is the only true law in the universe. So if you rename the field to a custom name like "timefield" - is it no longer considered a special case and will now follow the order specified by the fields or table command.

Another consideration is that when a field is called "_time" and contains an epoch time value - Splunk will automatically convert it to a readable format. However when you rename to something else, Splunk will just show the epoch value. So you also need to add a eval with strftime to convert the value to your preferred readable time.