Splunk Dev

Is there a way to export a CSV file that contains a header row even if there is no results from search?

brunoabreu
Loves-to-Learn Lots

I'm using Splunk Python SDK to download a search result as a CSV file.

The output file contains a header row if the search returns one or more events.

When there is no events from search, the CSV file generated is empty, without hearder row.

As a requirement, I need all generated CSV files to contain at least the header row even though the search does not return any events.

 

Labels (2)
0 Karma

preotesoiu
Path Finder

have not tried it but look into using 
| append [makeresults | eval "header_field"=header_field, ....]

0 Karma

brunoabreu
Loves-to-Learn Lots

It resulted in duplicated header row.

First one, the header itself, and the second one a row which contains field values identical to the header.

And actually it would be nice if I could add this header without the need of knowing the field names in advance.

Tags (2)
0 Karma

preotesoiu
Path Finder

can't test in my env right now, but look into adding some conditions to the append that are true only if the search before the append returns null values. I think this way you might eliminate the row.
Not sure about the field names, I think you might need to know them in advance. Perhaps leverage a lookup table and foreach command...

just some ideas...

0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...