Splunk Search

tables not displaying as desired

freeti00
Explorer

when using the following search:

source="/data/log/rla.log" eventtype="SessionStart" | convert ctime(_time) as timestr | table timestr, user, wanIP, NCIP, hostname | sendemail to=tim.freeman@blah.com sendresults=t

the columns start with wanIP, NCIP, timestr, etc.... Is there a way to force the order of the columns to what I want which is timestr, user, wanIP, etc...

Tags (1)

Stephen_Sorkin
Splunk Employee
Splunk Employee

This is bug SPL-31616 fixed in 4.1.4.

freeti00
Explorer

thanks, I will upgrade at the first oppourtunity

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...