Splunk Dev

Is there a way to export a CSV file that contains a header row even if there is no results from search?

brunoabreu
Loves-to-Learn Lots

I'm using Splunk Python SDK to download a search result as a CSV file.

The output file contains a header row if the search returns one or more events.

When there is no events from search, the CSV file generated is empty, without hearder row.

As a requirement, I need all generated CSV files to contain at least the header row even though the search does not return any events.

 

Labels (2)
0 Karma

preotesoiu
Path Finder

have not tried it but look into using 
| append [makeresults | eval "header_field"=header_field, ....]

0 Karma

brunoabreu
Loves-to-Learn Lots

It resulted in duplicated header row.

First one, the header itself, and the second one a row which contains field values identical to the header.

And actually it would be nice if I could add this header without the need of knowing the field names in advance.

Tags (2)
0 Karma

preotesoiu
Path Finder

can't test in my env right now, but look into adding some conditions to the append that are true only if the search before the append returns null values. I think this way you might eliminate the row.
Not sure about the field names, I think you might need to know them in advance. Perhaps leverage a lookup table and foreach command...

just some ideas...

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...