Splunk Search

How to change how fields are sorted and displayed when they are extracted from an event?

anthonysomerset
Path Finder

I have a voice CDR being imported into splunk, i have indexed extractions working perfectly as its ultimately a CSV file being ingested

However the fields as extracted are displayed in alphabetical order rather then the order they appear within the event itself. is there a way that i can change this behaviour so that I don't have to refer to the CSV definition manually each time?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The table command will display fields in the order specified.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

somesoni2
Revered Legend

I don't believe you can change this behavior. One workaround could be to create a macro (global sharing) with a table command with the field that you expect and use/ask users to use this macro. (in case the CSV file structure changes, you'd need to change in one place only)

richgalloway
SplunkTrust
SplunkTrust

The table command will display fields in the order specified.

---
If this reply helps you, Karma would be appreciated.

anthonysomerset
Path Finder

so if i understand correctly, i would have to pipe it through table and manually define the order of the fields, which should be easy as i can take this from the props.conf containing the extraction used in the first place?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Exactly so.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...