Splunk Search

Define field order on export

CerielTjuh
Path Finder

Hi there,

I have a saved search that I want to run every day at noon, I am sending the results trough mail and want to analyse them, but the fields order isn't logic.

host="fw.azl.local" type="event" subtype="admin" pri="notice" seq!="" | fields - _* | fields date, time, ui, user, msg, devname, sintf, dintf, saddr, daddr, svr, act

My results are in a different order then the one i am searching for (date, time, etc..) How can i make sure i have the same order in my mail as the search string ?

Thnx !

2 Solutions

kbecker
Communicator

I was told by support that the field order difference between the the web GUI and saved searches is a bug and should be resolved in 4.1.4.

View solution in original post

0 Karma

southeringtonp
Motivator

The email functionality is driven by a script called 'sendemail.py' in the search app. If you're brave, you can do this: - copy sendemail.py to sendemail-custom.py - make any changes you like in that script - add this to apps/search/local/commands.conf: [sendemail] filename = sendemail-custom.py

Your custom version can do whatever you want it to, but the drawback is you now have to maintain it if Splunk makes changes to the original (for example, the addition of PDF emails in Splunk 4.1)

I use a modified version of the script that adds CSS formatting to the email and re-orders the fields if it sees a 'fields' command in the search string.

View solution in original post

0 Karma

southeringtonp
Motivator

The email functionality is driven by a script called 'sendemail.py' in the search app. If you're brave, you can do this: - copy sendemail.py to sendemail-custom.py - make any changes you like in that script - add this to apps/search/local/commands.conf: [sendemail] filename = sendemail-custom.py

Your custom version can do whatever you want it to, but the drawback is you now have to maintain it if Splunk makes changes to the original (for example, the addition of PDF emails in Splunk 4.1)

I use a modified version of the script that adds CSS formatting to the email and re-orders the fields if it sees a 'fields' command in the search string.

0 Karma

kbecker
Communicator

I was told by support that the field order difference between the the web GUI and saved searches is a bug and should be resolved in 4.1.4.

0 Karma

CerielTjuh
Path Finder

Thnx guys, I will wait for the new release 🙂

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The script that sends emails out specifically re-orders fields by length of content (field with longest value first). I have modified the script to remove this logic, but yes it would be nice if that is being done permanently.

0 Karma

bfaber
Communicator

What version of Splunk is this? I think that the ordering was an issue prior to 4.0...

0 Karma

bfaber
Communicator

That may be a bug -- I'd send it to support@splunk.com...

0 Karma

CerielTjuh
Path Finder

Latest version, 4.1.2, I found out yesterday that if i create a new dashboard with the search, the order is fine, only when i create a saved search and let Splunk e-mail me the results it is messed up.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...