Developing for Splunk Enterprise

Ordering of results from Java SDK export search


According to "export" searches in the Java SDK return results in the opposite order to most Splunk searches:

  • Export: An export search is another type of search operation that runs immediately, does not create a job for the search, and starts streaming results immediately. Results are returned in reverse order from other searches―from the oldest results to the newest.

As far as I can see, that last sentence of this bullet point in the documentation is completely wrong. When I run an "export" search using the Java SDK the newest events are returned first. This is reproducible using the example program that comes with the SDK (described at

It would be brilliant if there was a way to export events in ascending time order using the SDK. Has anyone managed to do this?

Tags (3)

Re: Ordering of results from Java SDK export search


You are right. This seems to be a defect in our documentation. We will get it corrected soon.

Thanks for bringing this to our attention.

View solution in original post

0 Karma