Splunk Dev

Ordering of results from Java SDK export search

dmr195
Communicator

According to http://dev.splunk.com/view/splunk-java-sdk-how-to/SP-CAAAEHQ "export" searches in the Java SDK return results in the opposite order to most Splunk searches:

  • Export: An export search is another type of search operation that runs immediately, does not create a job for the search, and starts streaming results immediately. Results are returned in reverse order from other searches―from the oldest results to the newest.

As far as I can see, that last sentence of this bullet point in the documentation is completely wrong. When I run an "export" search using the Java SDK the newest events are returned first. This is reproducible using the example program that comes with the SDK (described at http://dev.splunk.com/view/SP-CAAAEFF#export).

It would be brilliant if there was a way to export events in ascending time order using the SDK. Has anyone managed to do this?

Tags (3)
1 Solution

Neeraj_Luthra
Splunk Employee
Splunk Employee

You are right. This seems to be a defect in our documentation. We will get it corrected soon.

Thanks for bringing this to our attention.

View solution in original post

0 Karma

Neeraj_Luthra
Splunk Employee
Splunk Employee

You are right. This seems to be a defect in our documentation. We will get it corrected soon.

Thanks for bringing this to our attention.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...