Why are the columns reordered when implementing reporting command?

[schose]

Hi forum,

I'm trying to implement a custom reporting command. Here is the smallest implementation which does nothing but giving the results back.

from __future__ import absolute_import, division, print_function, unicode_literals
import os

from splunklib.searchcommands import dispatch, ReportingCommand, Configuration, Option, validators
import sys
from splunklib import six

@Configuration()
class SavetableCommand(ReportingCommand):
    @Configuration()
    def map(self, records):
        return records

    def reduce(self, records):

        return records

dispatch(SavetableCommand, sys.argv, sys.stdin, sys.stdout, __name__)

Unfortunately this doesn't give me the correct order of the incoming resultset.
Example:

| tstats count values(source) as a where index=_internal by sourcetype  | table sourcetype count a | mycommand 

Gives back a table with a count sourcetype - so it looks like columns of the stats are reordered alphabetically.

How would it be possible to return the columns is in a correct order?!

Thanks and best regards,

Andreas

[nickhills]

Splunk's default behavior is to sort rows by _time, and columns by lexicographical order. (try |table * to see this)
If you want columns in a specific order you will have to |table z_field a_field m_field
When your command returns your results, it is ignorant of your previous table command, so you will need to format this yourself.

One option is to use a macro which invokes your command, and then formats the results with table.

[schose]

Hi nick,

thanks for your help. It looks like when it's implemented as StreamingCommand the columns are not reordered.