Building for the Splunk Platform

Ordering of results from Java SDK export search

dmr195
Communicator

According to http://dev.splunk.com/view/splunk-java-sdk-how-to/SP-CAAAEHQ "export" searches in the Java SDK return results in the opposite order to most Splunk searches:

  • Export: An export search is another type of search operation that runs immediately, does not create a job for the search, and starts streaming results immediately. Results are returned in reverse order from other searches―from the oldest results to the newest.

As far as I can see, that last sentence of this bullet point in the documentation is completely wrong. When I run an "export" search using the Java SDK the newest events are returned first. This is reproducible using the example program that comes with the SDK (described at http://dev.splunk.com/view/SP-CAAAEFF#export).

It would be brilliant if there was a way to export events in ascending time order using the SDK. Has anyone managed to do this?

Tags (3)
1 Solution

Neeraj_Luthra
Splunk Employee
Splunk Employee

You are right. This seems to be a defect in our documentation. We will get it corrected soon.

Thanks for bringing this to our attention.

View solution in original post

0 Karma

Neeraj_Luthra
Splunk Employee
Splunk Employee

You are right. This seems to be a defect in our documentation. We will get it corrected soon.

Thanks for bringing this to our attention.

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...