topic Re: How to change how fields are sorted and displayed when they are extracted from an event? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-change-how-fields-are-sorted-and-displayed-when-they-are/m-p/277286#M83621 <P>I don't believe you can change this behavior. One workaround could be to create a macro (global sharing) with a table command with the field that you expect and use/ask users to use this macro. (in case the CSV file structure changes, you'd need to change in one place only)</P> Mon, 12 Dec 2016 14:28:52 GMT somesoni2 2016-12-12T14:28:52Z How to change how fields are sorted and displayed when they are extracted from an event? https://community.splunk.com/t5/Splunk-Search/How-to-change-how-fields-are-sorted-and-displayed-when-they-are/m-p/277283#M83618 <P>I have a voice CDR being imported into splunk, i have indexed extractions working perfectly as its ultimately a CSV file being ingested</P> <P>However the fields as extracted are displayed in alphabetical order rather then the order they appear within the event itself. is there a way that i can change this behaviour so that I don't have to refer to the CSV definition manually each time?</P> Mon, 12 Dec 2016 13:03:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-how-fields-are-sorted-and-displayed-when-they-are/m-p/277283#M83618 anthonysomerset 2016-12-12T13:03:37Z Re: How to change how fields are sorted and displayed when they are extracted from an event? https://community.splunk.com/t5/Splunk-Search/How-to-change-how-fields-are-sorted-and-displayed-when-they-are/m-p/277284#M83619 <P>The <CODE>table</CODE> command will display fields in the order specified.</P> Mon, 12 Dec 2016 13:54:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-how-fields-are-sorted-and-displayed-when-they-are/m-p/277284#M83619 richgalloway 2016-12-12T13:54:44Z Re: How to change how fields are sorted and displayed when they are extracted from an event? https://community.splunk.com/t5/Splunk-Search/How-to-change-how-fields-are-sorted-and-displayed-when-they-are/m-p/277285#M83620 <P>so if i understand correctly, i would have to pipe it through table and manually define the order of the fields, which should be easy as i can take this from the props.conf containing the extraction used in the first place?</P> Mon, 12 Dec 2016 14:19:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-how-fields-are-sorted-and-displayed-when-they-are/m-p/277285#M83620 anthonysomerset 2016-12-12T14:19:22Z Re: How to change how fields are sorted and displayed when they are extracted from an event? https://community.splunk.com/t5/Splunk-Search/How-to-change-how-fields-are-sorted-and-displayed-when-they-are/m-p/277286#M83621 <P>I don't believe you can change this behavior. One workaround could be to create a macro (global sharing) with a table command with the field that you expect and use/ask users to use this macro. (in case the CSV file structure changes, you'd need to change in one place only)</P> Mon, 12 Dec 2016 14:28:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-how-fields-are-sorted-and-displayed-when-they-are/m-p/277286#M83621 somesoni2 2016-12-12T14:28:52Z Re: How to change how fields are sorted and displayed when they are extracted from an event? https://community.splunk.com/t5/Splunk-Search/How-to-change-how-fields-are-sorted-and-displayed-when-they-are/m-p/277287#M83622 <P>Exactly so.</P> Mon, 12 Dec 2016 16:52:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-how-fields-are-sorted-and-displayed-when-they-are/m-p/277287#M83622 richgalloway 2016-12-12T16:52:12Z