Alerting

Alert script : HOW TO fix the column order in the result.csv.gz

Micmac
Path Finder

Hi,

I actually execute a script when a schedule saved search is triggered.

My problem is :

I run multiple schedule saved search with the same number of fields and in result.csv.gz. I get this fields in random order in the result.gz.csv of the different saved searches ... this is a problem when I want to use the results.

Do you now if there is a way to fix the order of the column that we have in result.csv.gz ??

For more detail :

My saved searches end with the fields command like below :

[...]
| fields myfield_1,myfield_2,myfield_3,myfield_4

And sometimes I get in result.cvs.gz like below :

  • myfield_1,myfield_4,myfield_3,myfield_2,__mvfields...
  • myfield_1,myfield_2,myfield_3,myfield_4,__mvfields... (this is what I want all of the time)
  • myfield_1,__mvfield,myfield_2,_mvfield,myfield_3,_mvfield,myfield_4,__mvfield...

Thanks for your help.

0 Karma
1 Solution

Micmac
Path Finder

I've coded a workaround that works for the moment.

I've modified my script to get the position of the field that I want in the first line of the result.csv.gz header :

result_content=fResult.readlines()

if result_content:
  for line in result_content:
    aFields = line.split(",") 
    # get fields position
    if "__mv" in line: # the header line 
      iPos = 0
      for sField in aFields:
        if "__mv" not in sField:
          if "myfield_1" in sField:
            iPosfield_1 = iPos
          elif "myfield_2" in sField:
            iPosfield_2 = iPos
          [...]
        iPos += 1

I hope my solution will help ! If you have better please share 🙂

View solution in original post

Micmac
Path Finder

I've coded a workaround that works for the moment.

I've modified my script to get the position of the field that I want in the first line of the result.csv.gz header :

result_content=fResult.readlines()

if result_content:
  for line in result_content:
    aFields = line.split(",") 
    # get fields position
    if "__mv" in line: # the header line 
      iPos = 0
      for sField in aFields:
        if "__mv" not in sField:
          if "myfield_1" in sField:
            iPosfield_1 = iPos
          elif "myfield_2" in sField:
            iPosfield_2 = iPos
          [...]
        iPos += 1

I hope my solution will help ! If you have better please share 🙂

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...