Splunk Search

Why are the columns reordered when implementing reporting command?


Hi forum,

I'm trying to implement a custom reporting command. Here is the smallest implementation which does nothing but giving the results back.

from __future__ import absolute_import, division, print_function, unicode_literals
import os

from splunklib.searchcommands import dispatch, ReportingCommand, Configuration, Option, validators
import sys
from splunklib import six

class SavetableCommand(ReportingCommand):
    def map(self, records):
        return records

    def reduce(self, records):

        return records

dispatch(SavetableCommand, sys.argv, sys.stdin, sys.stdout, __name__)

Unfortunately this doesn't give me the correct order of the incoming resultset.

| tstats count values(source) as a where index=_internal by sourcetype  | table sourcetype count a | mycommand 

Gives back a table with a count sourcetype - so it looks like columns of the stats are reordered alphabetically.

How would it be possible to return the columns is in a correct order?!

Thanks and best regards,


0 Karma

Ultra Champion

Splunk's default behavior is to sort rows by _time, and columns by lexicographical order. (try |table * to see this)
If you want columns in a specific order you will have to |table z_field a_field m_field
When your command returns your results, it is ignorant of your previous table command, so you will need to format this yourself.

One option is to use a macro which invokes your command, and then formats the results with table.

If my comment helps, please give it a thumbs up!
0 Karma


Hi nick,

thanks for your help. It looks like when it's implemented as StreamingCommand the columns are not reordered.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...