Using the cURL/API to submit an
output_mode=csv export job like this:
search .... | table fieldA fieldB
Will give a CSV payload if there are any matching events, otherwise, it will return no data at all, not even a header.
Is it possible to force the header, even if there are no matching events? I know Splunk knows what the header should be, since
output_mode=xml will return the expected fields in a
Why not add a fake event at the end of each search, to never return an empty table ?
search .... | append [ | stats count | eval fieldA="null", fieldB="null" | fields - count ] | table fieldA fieldB
Thank you for the answer!
For me, your approach works, but isn't particularly scalable. I have ~ 50 queries that change frequently, and maintaining the column list in two points in the query is a bit fragile. The subsearch is also unbounded in time, so can be expensive on large indexes.
My current solution is to detect if no data was returned, then submit the query to the parsing endpoint, and extracting the fields from the
reportsSearch key. It's also fairly fragile (it depends on the last command being a
table), but it avoids the penalty of resubmitting the search.
Ideally Splunk would adjust things so that an
output_mode=csv would return the headers always, or at least expose an option for it.