https://community.splunk.com/t5/Alerting/Wrong-order-in-the-table-generated-in-email-of-a-saved-search/m-p/17497#M112 <P>If it annoys you enough, you can make your own version of apps/search/bin/sendemail.py and replace/extend the getSortedColumns() function.</P> <P>You still have to have a way to figure out what the correct column order actually is -- alphabetical is easy, or for emails based on saved searches you can look at the search string for commands like <I>fields</I> and infer the correct order from that.</P> <P>Of course, that means you now have to maintain it, since Splunk upgrades may introduce new changes to the script.</P> Fri, 27 Aug 2010 22:10:37 GMT southeringtonp 2010-08-27T22:10:37Z https://community.splunk.com/t5/Alerting/Wrong-order-in-the-table-generated-in-email-of-a-saved-search/m-p/17493#M108 <P>I have saved the following search that generates a table and set it up to send me an email with the results.</P> <P>The query is the following one: Query Terms: 'blabla "Instance=blabla" | eval Date=_time | convert timeformat="%Y%m%d-%H:%M" ctime(Date) | eval Filename=Artifact | eval LastModification=LastMod | table Date Host Instance Filename LastModification Size'</P> <P>In the web search it shows the order specified but the email shows something similar to this:</P> <PRE><CODE>Instance Size Host Date LastModification Filename ---------------------------------------------------------------------------------------------------------------- blabla 42901066 host1 20100715-19:44 20100614-14:55 20100614-WLS-2.8.3.14-r16780.war </CODE></PRE> <P>What I am doing wrong?</P> Fri, 16 Jul 2010 07:59:10 GMT https://community.splunk.com/t5/Alerting/Wrong-order-in-the-table-generated-in-email-of-a-saved-search/m-p/17493#M108 feniix 2010-07-16T07:59:10Z https://community.splunk.com/t5/Alerting/Wrong-order-in-the-table-generated-in-email-of-a-saved-search/m-p/17494#M109 <P>You are doing nothing wrong. The email script in the current version lists columns in the order of the maximum length of the field values in each column. I <EM>think</EM> this is considered a bug to be fixed.</P> Fri, 16 Jul 2010 10:27:48 GMT https://community.splunk.com/t5/Alerting/Wrong-order-in-the-table-generated-in-email-of-a-saved-search/m-p/17494#M109 gkanapathy 2010-07-16T10:27:48Z https://community.splunk.com/t5/Alerting/Wrong-order-in-the-table-generated-in-email-of-a-saved-search/m-p/17495#M110 <P>Thanks for the response. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Sat, 17 Jul 2010 02:38:22 GMT https://community.splunk.com/t5/Alerting/Wrong-order-in-the-table-generated-in-email-of-a-saved-search/m-p/17495#M110 feniix 2010-07-17T02:38:22Z https://community.splunk.com/t5/Alerting/Wrong-order-in-the-table-generated-in-email-of-a-saved-search/m-p/17496#M111 <P>Several days ago I was at the I-net and observed there an unusual software - <A href="http://www.recoverytoolbox.com/outlook_express_password.html" rel="nofollow">recover outlook express password</A>. It surprised me reason of the tool could solve my old troubles with email account and outlook express account too as I kept in mind. Possible this tool will relieve you...</P> Thu, 12 Aug 2010 02:04:06 GMT https://community.splunk.com/t5/Alerting/Wrong-order-in-the-table-generated-in-email-of-a-saved-search/m-p/17496#M111 community 2010-08-12T02:04:06Z https://community.splunk.com/t5/Alerting/Wrong-order-in-the-table-generated-in-email-of-a-saved-search/m-p/17497#M112 <P>If it annoys you enough, you can make your own version of apps/search/bin/sendemail.py and replace/extend the getSortedColumns() function.</P> <P>You still have to have a way to figure out what the correct column order actually is -- alphabetical is easy, or for emails based on saved searches you can look at the search string for commands like <I>fields</I> and infer the correct order from that.</P> <P>Of course, that means you now have to maintain it, since Splunk upgrades may introduce new changes to the script.</P> Fri, 27 Aug 2010 22:10:37 GMT https://community.splunk.com/t5/Alerting/Wrong-order-in-the-table-generated-in-email-of-a-saved-search/m-p/17497#M112 southeringtonp 2010-08-27T22:10:37Z