How to change how fields are sorted and displayed when they are extracted from an event?

[anthonysomerset]

I have a voice CDR being imported into splunk, i have indexed extractions working perfectly as its ultimately a CSV file being ingested

However the fields as extracted are displayed in alphabetical order rather then the order they appear within the event itself. is there a way that i can change this behaviour so that I don't have to refer to the CSV definition manually each time?

[somesoni2]

I don't believe you can change this behavior. One workaround could be to create a macro (global sharing) with a table command with the field that you expect and use/ask users to use this macro. (in case the CSV file structure changes, you'd need to change in one place only)

[richgalloway · Accepted solution]

The table command will display fields in the order specified.

[anthonysomerset]

so if i understand correctly, i would have to pipe it through table and manually define the order of the fields, which should be easy as i can take this from the props.conf containing the extraction used in the first place?

[richgalloway]

Exactly so.