mySearch | table * generates nice table of all my ~150 fields with default field names field1 field2... field10... fiel100 field101 so on but the output Table columns are ordered alphabetically meaning field1 field10 field100 field101 so on. How can I order the columns so the table show field1 field2 field3.... ?
Thank you
Splunk is doing correctly, coz field1, field10,field2 i correct ordering.
The only way i could think of is to "pad" your field names with zeroes, so it becomes
field001, field002,field003... , field010,field011.... field100,field101 etc
Inroder to do that
1. Do it manually one time (may be easier here).=> Just put each field to do rename eg: |rename field1 as field001
and put as a macro . So your search should be . => ...| rename_my_fields
| table field*
2. Do using some kind of regex to pad ....|foreach field* [eval newfield=<<FIELD>>] table field*