Thanks for the suggestion. We tried that already and that is not it. still gives the following since version 9.0.x.  I'm starting to think this is just a bug. I have been able to confirm this behavior on 2 separate Splunk environments already since we upgraded them from version 8 to 9. ... View more

When using the | sendemail command and setting 'sendcsv=true' in our old situation the attached .csv file would have the same column order of our search. It appears that since upgrading to 9.0.3 from 8.1.x, we can no longer influence the column order in our .csv file. An example:  Our search would be  | .... | table a b c | sendemail to=... sendcsv=true Which in our old situation would keep the column order of our | table command. Now it would be 'b c a' in the .csv file attached in the mail instead of 'a b c'. Whatever order for the table we set in our search no longer influences the .csv file.  Hope this clarifies it a bit. ... View more