Splunk Search

How to change how fields are sorted and displayed when they are extracted from an event?

anthonysomerset
Path Finder

I have a voice CDR being imported into splunk, i have indexed extractions working perfectly as its ultimately a CSV file being ingested

However the fields as extracted are displayed in alphabetical order rather then the order they appear within the event itself. is there a way that i can change this behaviour so that I don't have to refer to the CSV definition manually each time?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The table command will display fields in the order specified.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

somesoni2
Revered Legend

I don't believe you can change this behavior. One workaround could be to create a macro (global sharing) with a table command with the field that you expect and use/ask users to use this macro. (in case the CSV file structure changes, you'd need to change in one place only)

richgalloway
SplunkTrust
SplunkTrust

The table command will display fields in the order specified.

---
If this reply helps you, Karma would be appreciated.

anthonysomerset
Path Finder

so if i understand correctly, i would have to pipe it through table and manually define the order of the fields, which should be easy as i can take this from the props.conf containing the extraction used in the first place?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Exactly so.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...