Splunk Dev

Is there a way to export a CSV file that contains a header row even if there is no results from search?

brunoabreu
Loves-to-Learn Lots

I'm using Splunk Python SDK to download a search result as a CSV file.

The output file contains a header row if the search returns one or more events.

When there is no events from search, the CSV file generated is empty, without hearder row.

As a requirement, I need all generated CSV files to contain at least the header row even though the search does not return any events.

 

Labels (2)
0 Karma

preotesoiu
Path Finder

have not tried it but look into using 
| append [makeresults | eval "header_field"=header_field, ....]

0 Karma

brunoabreu
Loves-to-Learn Lots

It resulted in duplicated header row.

First one, the header itself, and the second one a row which contains field values identical to the header.

And actually it would be nice if I could add this header without the need of knowing the field names in advance.

Tags (2)
0 Karma

preotesoiu
Path Finder

can't test in my env right now, but look into adding some conditions to the append that are true only if the search before the append returns null values. I think this way you might eliminate the row.
Not sure about the field names, I think you might need to know them in advance. Perhaps leverage a lookup table and foreach command...

just some ideas...

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...