Splunk Search

Why would a command via CLI that exports to a CSV re-order the columns? Looks like the columns get re-ordered alphanumerically.

kuja
Splunk Employee
Splunk Employee

Splunk Web search ran:

sourcetype=vmstat |head 10| table _time source sourcetype mem_free

OUTPUT is as listed above in that order

Splunk CLI command ran:

root@<machine_name>:/opt/splunk/bin# ./splunk search "sourcetype=vmstat |head 10| table _time source sourcetype mem_free" -maxout 20 -output csv "_time", source, sourcetype, mem_free > test.csv

The order that it shows in the output is alphabetical rather than in the order requested like the UI delivers. Is this expected behavior?

inventsekar
Ultra Champion

i think, the table command changes the output file format.
the -output csv (or table) does not affect the final file format.

please try -

splunk@machine:~/bin> ./splunk search "index=os_nix sourcetype=vmstat earliest=-5m@m latest=now |head 10| table _time source host sourcetype mem_free" -maxout 20 -output table _time, sourcetype, host, source, mem_free > test2.csv

INFO: Your timerange was substituted based on your search string

splunk@machine:~/bin> ./splunk search "index=os_nix sourcetype=vmstat earliest=-5m@m latest=now |head 10| table source host _time sourcetype mem_free" -maxout 20 -output table _time, sourcetype, host, source, mem_free > test3.csv

INFO: Your timerange was substituted based on your search string

0 Karma

gwiner
New Member

Mine isn't even alphabetical. The column that should be first is actually last.

0 Karma

carlostapia01
New Member

I'm dealing with same issue. Does anyone has solved this nice behaviour?

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...