When using the | sendemail command and setting 'sendcsv=true' in our old situation the attached .csv file would have the same column order of our search. It appears that since upgrading to 9.0.3 from 8.1.x, we can no longer influence the column order in our .csv file. An example: Our search would be | .... | table a b c | sendemail to=... sendcsv=true Which in our old situation would keep the column order of our | table command. Now it would be 'b c a' in the .csv file attached in the mail instead of 'a b c'. Whatever order for the table we set in our search no longer influences the .csv file. Hope this clarifies it a bit.
... View more