Splunk Search

search/jobs/export changes order of columns unexpectedly



we're using Splunk SDK to do regular exports of data (as a CSV file). We've been using regular search jobs some time ago and that worked fine except that it was rather difficult to fetch results with more than 50.000 rows - we had to fetch it piece by piece.

Recently we switched to search/jobs/export endpoint which is much easier to use, but it seems to rearrange the columns for some queries - for example the query ends with "table A,B,C" but the resulting CSV is "C,A,B". This makes the processing of the exported data very difficult.

Why is this happening and how to make it stop?

I've found several questions here, but none with an answer or an explanation why it happens. I've also searched the docs for info about this behavior without success.

Tags (3)
0 Karma

Splunk Employee
Splunk Employee

The export endpoint does not honor the field order as defined in the search query but you should be able to pass an array of fields as an argument - "f". This way you can dictate the fields and their order in the export results.

Assuming you are using Python SDK, the code may look something like this ...

result = service.get('search/jobs/export',

Hope this helps. If you are using another SDK and need help with that, feel free to email me - nluthra@splunk.com.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...