Why is Splunk email csv column order not being the same as search?

[Tim_Accenture]

Recently we discovered that our Splunk sendemail command in combination with the sendcsv option is no longer using the same order for the columns as the search itself. We suspect that that has been broken since we upgraded from 8.x to 9.0.3. We've tried messing around with the width_sort_columns, but this hasn't produced the results we're looking for. Has anyone else experienced the same issues and maybe already found a solution?

[woodcock]

Could be this:

width_sort_columnsSyntax: width_sort_columns=<boolean>Description: This is only valid for plain text emails. Specifies whether the columns should be sorted by their width.Default: true

From here:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sendemail

[Tim_Accenture]

Thanks for the suggestion. We tried that already and that is not it.

still gives the following since version 9.0.x. 

I'm starting to think this is just a bug. I have been able to confirm this behavior on 2 separate Splunk environments already since we upgraded them from version 8 to 9.

[woodcock]

Open a support ticket but ALSO go to the documentation page that I listed and go to the bottom and send them feedback and point to this answers post.  They dox team is GREAT and they will get to the bottom of it.

[Tim_Accenture]

When using the | sendemail command and setting 'sendcsv=true' in our old situation the attached .csv file would have the same column order of our search. It appears that since upgrading to 9.0.3 from 8.1.x, we can no longer influence the column order in our .csv file.

An example: 

Our search would be 

| ....
| table a b c
| sendemail to=... sendcsv=true

Which in our old situation would keep the column order of our | table command. Now it would be 'b c a' in the .csv file attached in the mail instead of 'a b c'. Whatever order for the table we set in our search no longer influences the .csv file. 

Hope this clarifies it a bit.

[woodcock]

Be specific here.