fields order when using splunk search in command line

[patrice_boodhoo]

I would like to have the same order of fields from the result when executing a search command from the user interface and from command line.

Eg when I execute
index=idx_lyl earliest=10/01/2014:0:0:0 latest=11/03/2014:23:59:59 criticity!=".Info" AND criticity!=".Debug" AND criticity!="*Notice" | timechart count by criticity | sort + _time

from the Splunk UI, the fields are in that order
"_time","-.Error","Daemon.Error","Daemon.Warning","Kern.Alert","Kern.Critical","Kern.Error","Kern.Warning","Local4.Error","Local7.Error","Local7.Warning",OTHER

But when I ran the same search from command line the fields are in a different order ie
"-.Error","Daemon.Error","Daemon.Warning","Kern.Alert","Kern.Critical","Kern.Error","Kern.Warning","Local4.Error","Local7.Error","Local7.Warning",OTHER,"_time","_span","_spandays"

The search from command line being used is
splunk search "index=idx_lyl earliest=10/01/2014:0:0:0 latest=11/03/2014:23:59:59 criticity!=\".Info\" AND criticity!=\".Debug\" AND criticity!=\"*Notice\"
| timechart count by criticity | sort + _time" -preview 0 -maxout 0 -output csv > result.csv

Thanks

[fdi01]

To determine priority among the collection of fields resulting of an search in the CLI, Splunk uses ASCII sort order. Fields named "A" have a higher priority than fields named "B", and so on. Also, all fields with an uppercase letter have precedence over any fields starting with a lowercase letter, due to ASCII sort order.
this case that you have in CLI "-.Error","Daemon.Error","Daemon.Warning","Kern.Alert","Kern.Critical","Kern.Error","Kern.Warning",
"Local4.Error","Local7.Error","Local7.Warning",OTHER,"_time","_span","_spandays" is ASCII sort order.
but run this search in CLI:

    ./splunk search "index=idx_lyl earliest=10/01/2014:0:0:0 latest=11/03/2014:23:59:59 criticity!=".Info" AND criticity!=".Debug" AND criticity!="*Notice"
    | timechart count by criticity |table  "_time", "-.Error", "Daemon.Error", "Daemon.Warning", "Kern.Alert", "Kern.Critical", "Kern.Error", "Kern.Warning", "Local4.Error", "Local7.Error", "Local7.Warning", OTHER| sort + _time" -preview 0 -maxout 0 -output csv > result.csv

or
./splunk search "index=idx_lyl earliest=10/01/2014:0:0:0 latest=11/03/2014:23:59:59 criticity!=".Info" AND criticity!=".Debug" AND criticity!="*Notice"
| timechart count by criticity |fields "_time", "-.Error", "Daemon.Error", "Daemon.Warning", "Kern.Alert", "Kern.Critical", "Kern.Error", "Kern.Warning", "Local4.Error", "Local7.Error", "Local7.Warning", OTHER| sort + _time" -preview 0 -maxout 0 -output csv > result.csv

[vasanthmss]

you can mention the field order using fields command,

your search .. | fields field1, field2, field3, field4....