topic Re: Why would a command via CLI that exports to a CSV re-order the columns? Looks like the columns get re-ordered alphanumerically. in Splunk Search

Why would a command via CLI that exports to a CSV re-order the columns? Looks like the columns get re-ordered alphanumerically.

kuja — Tue, 13 Oct 2015 21:34:22 GMT

Splunk Web search ran:

sourcetype=vmstat |head 10| table _time source sourcetype mem_free

OUTPUT is as listed above in that order

Splunk CLI command ran:

root@<machine_name>:/opt/splunk/bin# ./splunk search "sourcetype=vmstat |head 10| table _time source sourcetype mem_free" -maxout 20 -output csv "_time", source, sourcetype, mem_free > test.csv

The order that it shows in the output is alphabetical rather than in the order requested like the UI delivers. Is this expected behavior?

Re: Why would a command via CLI that exports to a CSV re-order the columns? Looks like the columns get re-ordered alphanumerically.

carlostapia01 — Tue, 15 Mar 2016 02:36:07 GMT

I'm dealing with same issue. Does anyone has solved this nice behaviour?

Re: Why would a command via CLI that exports to a CSV re-order the columns? Looks like the columns get re-ordered alphanumerically.

gwiner — Thu, 22 Sep 2016 23:55:22 GMT

Mine isn't even alphabetical. The column that should be first is actually last.

Re: Why would a command via CLI that exports to a CSV re-order the columns? Looks like the columns get re-ordered alphanumerically.

inventsekar — Fri, 23 Sep 2016 01:17:05 GMT

i think, the table command changes the output file format.
the -output csv (or table) does not affect the final file format.

please try -

splunk@machine:~/bin> ./splunk search "index=os_nix sourcetype=vmstat earliest=-5m@m latest=now |head 10| table _time source host sourcetype mem_free" -maxout 20 -output table _time, sourcetype, host, source, mem_free > test2.csv

INFO: Your timerange was substituted based on your search string

splunk@machine:~/bin> ./splunk search "index=os_nix sourcetype=vmstat earliest=-5m@m latest=now |head 10| table source host _time sourcetype mem_free" -maxout 20 -output table _time, sourcetype, host, source, mem_free > test3.csv

INFO: Your timerange was substituted based on your search string