I'm using Splunk Python SDK to download a search result as a CSV file.
The output file contains a header row if the search returns one or more events.
When there is no events from search, the CSV file generated is empty, without hearder row.
As a requirement, I need all generated CSV files to contain at least the header row even though the search does not return any events.
can't test in my env right now, but look into adding some conditions to the append that are true only if the search before the append returns null values. I think this way you might eliminate the row.
Not sure about the field names, I think you might need to know them in advance. Perhaps leverage a lookup table and foreach command...
just some ideas...