I'm trying to implement a custom reporting command. Here is the smallest implementation which does nothing but giving the results back.
from __future__ import absolute_import, division, print_function, unicode_literals import os from splunklib.searchcommands import dispatch, ReportingCommand, Configuration, Option, validators import sys from splunklib import six @Configuration() class SavetableCommand(ReportingCommand): @Configuration() def map(self, records): return records def reduce(self, records): return records dispatch(SavetableCommand, sys.argv, sys.stdin, sys.stdout, __name__)
Unfortunately this doesn't give me the correct order of the incoming resultset.
| tstats count values(source) as a where index=_internal by sourcetype | table sourcetype count a | mycommand
Gives back a table with a count sourcetype - so it looks like columns of the stats are reordered alphabetically.
How would it be possible to return the columns is in a correct order?!
Thanks and best regards,
Splunk's default behavior is to sort rows by _time, and columns by lexicographical order. (try
|table * to see this)
If you want columns in a specific order you will have to
|table z_field a_field m_field
When your command returns your results, it is ignorant of your previous table command, so you will need to format this yourself.
One option is to use a macro which invokes your command, and then formats the results with table.