Thanks for your reply. I will definitely try that. ... View more

Hi, I have the same problem : When I use stats or chart function in splunk my columns displayed in the good order. But if I export the result to CSV sometimes the columns order change. Please if someone know how to force columns order when using OPTION "-output csv" in search command. How did you fix it ! Best Regard ... View more

The fieldformat search command isn't supported until Splunk 4.2. ... View more

Thanks a lot. That's an easy solution. ... View more

Thanks for the quick response. I tried using fieldformat comamnd but I got "Search operation 'fieldformat' is unknown. You might not have permission to run this operation." I am using Splunk 4.1.2 version. Is fieldformat available in this version? ... View more

You can try something like this within the search query - | gentimes start=-1 | eval IP_ADDRESS="10.10.10.10" | eval SEARCH=if(match(IP_ADDRESS,"^\d+\.\d+\.\d+\.\d+$"),[search index=<your_index> earliest=-1m | stats count as count1 by index| return $count1 ] ,"invalid input") | table SEARCH Here if value of user entered IP_ADDRESS doesn't match the pattern, it will show "invalid input" in the results, else it shows the count from the subsearch. ... View more