Hi forum,
I'm trying to implement a custom reporting command. Here is the smallest implementation which does nothing but giving the results back.
from __future__ import absolute_import, division, print_function, unicode_literals
import os
from splunklib.searchcommands import dispatch, ReportingCommand, Configuration, Option, validators
import sys
from splunklib import six
@Configuration()
class SavetableCommand(ReportingCommand):
@Configuration()
def map(self, records):
return records
def reduce(self, records):
return records
dispatch(SavetableCommand, sys.argv, sys.stdin, sys.stdout, __name__)
Unfortunately this doesn't give me the correct order of the incoming resultset.
Example:
| tstats count values(source) as a where index=_internal by sourcetype | table sourcetype count a | mycommand
Gives back a table with a count sourcetype - so it looks like columns of the stats are reordered alphabetically.
How would it be possible to return the columns is in a correct order?!
Thanks and best regards,
Andreas
Splunk's default behavior is to sort rows by _time, and columns by lexicographical order. (try |table *
to see this)
If you want columns in a specific order you will have to |table z_field a_field m_field
When your command returns your results, it is ignorant of your previous table command, so you will need to format this yourself.
One option is to use a macro which invokes your command, and then formats the results with table.
Hi nick,
thanks for your help. It looks like when it's implemented as StreamingCommand the columns are not reordered.