Splunk Search

Why are the columns reordered when implementing reporting command?

schose
Builder

Hi forum,

I'm trying to implement a custom reporting command. Here is the smallest implementation which does nothing but giving the results back.

from __future__ import absolute_import, division, print_function, unicode_literals
import os

from splunklib.searchcommands import dispatch, ReportingCommand, Configuration, Option, validators
import sys
from splunklib import six

@Configuration()
class SavetableCommand(ReportingCommand):
    @Configuration()
    def map(self, records):
        return records

    def reduce(self, records):

        return records

dispatch(SavetableCommand, sys.argv, sys.stdin, sys.stdout, __name__)

Unfortunately this doesn't give me the correct order of the incoming resultset.
Example:

| tstats count values(source) as a where index=_internal by sourcetype  | table sourcetype count a | mycommand 

Gives back a table with a count sourcetype - so it looks like columns of the stats are reordered alphabetically.

How would it be possible to return the columns is in a correct order?!

Thanks and best regards,

Andreas

0 Karma

nickhills
Ultra Champion

Splunk's default behavior is to sort rows by _time, and columns by lexicographical order. (try |table * to see this)
If you want columns in a specific order you will have to |table z_field a_field m_field
When your command returns your results, it is ignorant of your previous table command, so you will need to format this yourself.

One option is to use a macro which invokes your command, and then formats the results with table.

If my comment helps, please give it a thumbs up!
0 Karma

schose
Builder

Hi nick,

thanks for your help. It looks like when it's implemented as StreamingCommand the columns are not reordered.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...