Wrong order in the table generated in email of a saved search?

[feniix]

I have saved the following search that generates a table and set it up to send me an email with the results.

The query is the following one: Query Terms: 'blabla "Instance=blabla" | eval Date=_time | convert timeformat="%Y%m%d-%H:%M" ctime(Date) | eval Filename=Artifact | eval LastModification=LastMod | table Date Host Instance Filename LastModification Size'

In the web search it shows the order specified but the email shows something similar to this:

Instance    Size        Host            Date           LastModification   Filename
----------------------------------------------------------------------------------------------------------------
blabla    42901066      host1         20100715-19:44    20100614-14:55    20100614-WLS-2.8.3.14-r16780.war

What I am doing wrong?

[southeringtonp]

If it annoys you enough, you can make your own version of apps/search/bin/sendemail.py and replace/extend the getSortedColumns() function.

You still have to have a way to figure out what the correct column order actually is -- alphabetical is easy, or for emails based on saved searches you can look at the search string for commands like fields and infer the correct order from that.

Of course, that means you now have to maintain it, since Splunk upgrades may introduce new changes to the script.

[community]

Several days ago I was at the I-net and observed there an unusual software - recover outlook express password. It surprised me reason of the tool could solve my old troubles with email account and outlook express account too as I kept in mind. Possible this tool will relieve you...

[gkanapathy · Accepted solution]

You are doing nothing wrong. The email script in the current version lists columns in the order of the maximum length of the field values in each column. I think this is considered a bug to be fixed.

[feniix]

Thanks for the response. 🙂