I'm using Splunk Python SDK to download a search result as a CSV file.
The output file contains a header row if the search returns one or more events.
When there is no events from search, the CSV file generated is empty, without hearder row.
As a requirement, I need all generated CSV files to contain at least the header row even though the search does not return any events.
have not tried it but look into using
| append [makeresults | eval "header_field"=header_field, ....]
can't test in my env right now, but look into adding some conditions to the append that are true only if the search before the append returns null values. I think this way you might eliminate the row.
Not sure about the field names, I think you might need to know them in advance. Perhaps leverage a lookup table and foreach command...
just some ideas...