https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100981#M26088 <P>Hi MuS,</P> <P>when i am used like this..i am getting the newraw values alone...Received , Sent are not at all displayin ..pls help..</P> Thu, 25 Oct 2012 15:59:10 GMT rakesh_498115 2012-10-25T15:59:10Z https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100977#M26084 <P>Hi.</P> <P>When i am using the table command ? i am not getting the fields in the order i have ginen ??<BR /> how can i do it be in the same order which i have mentioned ??</P> <P>my query is :</P> <P>soucetype="mydata" | table _raw,Recieved,Sent</P> <P>i want this order of display . but i am gettin in Received,Sent,_raw in this order ..pls help..i want the same order mentiond with the table commmand .. </P> Wed, 24 Oct 2012 12:59:38 GMT https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100977#M26084 rakesh_498115 2012-10-24T12:59:38Z https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100978#M26085 <P>Use <CODE>fields</CODE>.</P> <PRE><CODE>fields _raw,Received,Sent </CODE></PRE> Wed, 24 Oct 2012 14:33:40 GMT https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100978#M26085 Ayn 2012-10-24T14:33:40Z https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100979#M26086 <P>fields command is not working like this .... <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Thu, 25 Oct 2012 10:06:19 GMT https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100979#M26086 rakesh_498115 2012-10-25T10:06:19Z https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100980#M26087 <P>Hi </P> <P>it took me some reading the docs and trying out of some commands and I got what you are looking for <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>the easiest way is to rename _raw to anything and use the new field name in the table:</P> <PRE><CODE> soucetype="mydata" | rename _raw as newraw | table newraw, Recieved, Sent </CODE></PRE> <P>there are probably more effective ways of doing this, but it worked for example you provided and it answers your question.</P> <P>cheers,</P> <P>MuS</P> Thu, 25 Oct 2012 11:00:35 GMT https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100980#M26087 MuS 2012-10-25T11:00:35Z https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100981#M26088 <P>Hi MuS,</P> <P>when i am used like this..i am getting the newraw values alone...Received , Sent are not at all displayin ..pls help..</P> Thu, 25 Oct 2012 15:59:10 GMT https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100981#M26088 rakesh_498115 2012-10-25T15:59:10Z https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100982#M26089 <P>rakesh, sorry but I hope you are aware that you can scroll a windows not only up and down but also to the left or to the right? _raw is usually very long, therefore received and sent are WAY ON THE RIGHT of your screen.</P> Fri, 26 Oct 2012 08:01:09 GMT https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100982#M26089 MuS 2012-10-26T08:01:09Z https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100983#M26090 <P>Thans Mus .. i got it now ..:)</P> Fri, 26 Oct 2012 19:23:26 GMT https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100983#M26090 rakesh_498115 2012-10-26T19:23:26Z https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100984#M26091 <P>Best way to do it as below<BR /> <STRONG><EM>soucetype="mydata" | rename _raw as newraw | table Recieved, Sent, newraw</EM></STRONG><BR /> it will adjust raw data at most right position.</P> Wed, 20 Jul 2016 04:08:48 GMT https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100984#M26091 rajeev_ku 2016-07-20T04:08:48Z https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100985#M26092 <P>| table Receive,sent,_raw</P> Thu, 07 Feb 2019 07:01:05 GMT https://community.splunk.com/t5/Splunk-Search/order-changing-with-the-table-command/m-p/100985#M26092 arihant16cse 2019-02-07T07:01:05Z