Splunk Search

Search with output_mode=csv ends up reordering the table command output.

paragcisco
Explorer

I am doing something like this:
[ignore some syntax issues]

curl ... https://..../search/jobs/export -d 'search=search index=xyz ... | table Fld1 Fld2' -d output_mode=csv

Expected output (as given to table command) is:
Fld1,Fl2
123,abc

Actual output is
Fld2,Fld1
abc ,123

Any idea why it is getting re-ordered and how can I get it in the format I want?

Tags (3)

ShaneNewman
Motivator

I ran into a similar issue... Ended up using .... | table field1 field2 | outputcsv foo.csv and it corrected the problem.

Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...