https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-force-CSV-header-in-export-job-with-output/m-p/482499#M82681 <P>Thank you for the answer!</P> <P>For me, your approach works, but isn't particularly scalable. I have ~ 50 queries that change frequently, and maintaining the column list in two points in the query is a bit fragile. The subsearch is also unbounded in time, so can be expensive on large indexes.</P> <P>My current solution is to detect if no data was returned, then submit the query to the parsing endpoint, and extracting the fields from the <CODE>reportsSearch</CODE> key. It's also fairly fragile (it depends on the last command being a <CODE>table</CODE>), but it avoids the penalty of resubmitting the search.</P> <P>Ideally Splunk would adjust things so that an <CODE>output_mode=csv</CODE> would return the headers always, or at least expose an option for it.</P> Thu, 14 Nov 2019 14:56:58 GMT iroddis 2019-11-14T14:56:58Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-force-CSV-header-in-export-job-with-output/m-p/482497#M82679 <P>Using the cURL/API to submit an <CODE>output_mode=csv</CODE> export job like this:</P> <PRE><CODE>search .... | table fieldA fieldB </CODE></PRE> <P>Will give a CSV payload if there are any matching events, otherwise, it will return no data at all, not even a header.</P> <P>Is it possible to force the header, even if there are no matching events? I know Splunk knows what the header should be, since <CODE>output_mode=xml</CODE> will return the expected fields in a <CODE>&lt;fieldOrder&gt;</CODE> set.</P> Tue, 12 Nov 2019 16:17:12 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-force-CSV-header-in-export-job-with-output/m-p/482497#M82679 iroddis 2019-11-12T16:17:12Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-force-CSV-header-in-export-job-with-output/m-p/482498#M82680 <P>Why not add a fake event at the end of each search, to never return an empty table ?</P> <PRE><CODE>search .... | append [ | stats count | eval fieldA="null", fieldB="null" | fields - count ] | table fieldA fieldB </CODE></PRE> Thu, 14 Nov 2019 00:32:54 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-force-CSV-header-in-export-job-with-output/m-p/482498#M82680 yannK 2019-11-14T00:32:54Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-force-CSV-header-in-export-job-with-output/m-p/482499#M82681 <P>Thank you for the answer!</P> <P>For me, your approach works, but isn't particularly scalable. I have ~ 50 queries that change frequently, and maintaining the column list in two points in the query is a bit fragile. The subsearch is also unbounded in time, so can be expensive on large indexes.</P> <P>My current solution is to detect if no data was returned, then submit the query to the parsing endpoint, and extracting the fields from the <CODE>reportsSearch</CODE> key. It's also fairly fragile (it depends on the last command being a <CODE>table</CODE>), but it avoids the penalty of resubmitting the search.</P> <P>Ideally Splunk would adjust things so that an <CODE>output_mode=csv</CODE> would return the headers always, or at least expose an option for it.</P> Thu, 14 Nov 2019 14:56:58 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-force-CSV-header-in-export-job-with-output/m-p/482499#M82681 iroddis 2019-11-14T14:56:58Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-force-CSV-header-in-export-job-with-output/m-p/482500#M82682 <P>Understood, if you have a support contract, you can still open an enhancement request case on the product, to request outputlookup options.</P> Thu, 14 Nov 2019 16:03:27 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-force-CSV-header-in-export-job-with-output/m-p/482500#M82682 yannK 2019-11-14T16:03:27Z