Is it possible to force CSV header in export job with output_mode=csv and no matching events?

[iroddis]

Using the cURL/API to submit an output_mode=csv export job like this:

search .... | table fieldA fieldB

Will give a CSV payload if there are any matching events, otherwise, it will return no data at all, not even a header.

Is it possible to force the header, even if there are no matching events? I know Splunk knows what the header should be, since output_mode=xml will return the expected fields in a <fieldOrder> set.

[yannK]

Why not add a fake event at the end of each search, to never return an empty table ?

search ....  | append [ | stats count | eval fieldA="null", fieldB="null" | fields - count ]  | table fieldA fieldB

[iroddis]

Thank you for the answer!

For me, your approach works, but isn't particularly scalable. I have ~ 50 queries that change frequently, and maintaining the column list in two points in the query is a bit fragile. The subsearch is also unbounded in time, so can be expensive on large indexes.

My current solution is to detect if no data was returned, then submit the query to the parsing endpoint, and extracting the fields from the reportsSearch key. It's also fairly fragile (it depends on the last command being a table), but it avoids the penalty of resubmitting the search.

Ideally Splunk would adjust things so that an output_mode=csv would return the headers always, or at least expose an option for it.

[yannK]

Understood, if you have a support contract, you can still open an enhancement request case on the product, to request outputlookup options.