Splunk Web search ran:
sourcetype=vmstat |head 10| table _time source sourcetype mem_free
OUTPUT is as listed above in that order
Splunk CLI command ran:
root@<machine_name>:/opt/splunk/bin# ./splunk search "sourcetype=vmstat |head 10| table _time source sourcetype mem_free" -maxout 20 -output csv "_time", source, sourcetype, mem_free > test.csv
The order that it shows in the output is alphabetical rather than in the order requested like the UI delivers. Is this expected behavior?
i think, the table command changes the output file format.
the -output csv (or table) does not affect the final file format.
please try -
splunk@machine:~/bin> ./splunk search "index=os_nix sourcetype=vmstat earliest=-5m@m latest=now |head 10| table _time source host sourcetype mem_free" -maxout 20 -output table _time, sourcetype, host, source, mem_free > test2.csv
INFO: Your timerange was substituted based on your search string
splunk@machine:~/bin> ./splunk search "index=os_nix sourcetype=vmstat earliest=-5m@m latest=now |head 10| table source host _time sourcetype mem_free" -maxout 20 -output table _time, sourcetype, host, source, mem_free > test3.csv
INFO: Your timerange was substituted based on your search string
Mine isn't even alphabetical. The column that should be first is actually last.
I'm dealing with same issue. Does anyone has solved this nice behaviour?