Splunk Dev

Ordering of results from Java SDK export search

dmr195
Communicator

According to http://dev.splunk.com/view/splunk-java-sdk-how-to/SP-CAAAEHQ "export" searches in the Java SDK return results in the opposite order to most Splunk searches:

  • Export: An export search is another type of search operation that runs immediately, does not create a job for the search, and starts streaming results immediately. Results are returned in reverse order from other searches―from the oldest results to the newest.

As far as I can see, that last sentence of this bullet point in the documentation is completely wrong. When I run an "export" search using the Java SDK the newest events are returned first. This is reproducible using the example program that comes with the SDK (described at http://dev.splunk.com/view/SP-CAAAEFF#export).

It would be brilliant if there was a way to export events in ascending time order using the SDK. Has anyone managed to do this?

Tags (3)
1 Solution

Neeraj_Luthra
Splunk Employee
Splunk Employee

You are right. This seems to be a defect in our documentation. We will get it corrected soon.

Thanks for bringing this to our attention.

View solution in original post

0 Karma

Neeraj_Luthra
Splunk Employee
Splunk Employee

You are right. This seems to be a defect in our documentation. We will get it corrected soon.

Thanks for bringing this to our attention.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...