Splunk Dev

Is there a way to export a CSV file that contains a header row even if there is no results from search?

brunoabreu
Loves-to-Learn Lots

I'm using Splunk Python SDK to download a search result as a CSV file.

The output file contains a header row if the search returns one or more events.

When there is no events from search, the CSV file generated is empty, without hearder row.

As a requirement, I need all generated CSV files to contain at least the header row even though the search does not return any events.

 

Labels (2)
0 Karma

preotesoiu
Path Finder

have not tried it but look into using 
| append [makeresults | eval "header_field"=header_field, ....]

0 Karma

brunoabreu
Loves-to-Learn Lots

It resulted in duplicated header row.

First one, the header itself, and the second one a row which contains field values identical to the header.

And actually it would be nice if I could add this header without the need of knowing the field names in advance.

Tags (2)
0 Karma

preotesoiu
Path Finder

can't test in my env right now, but look into adding some conditions to the append that are true only if the search before the append returns null values. I think this way you might eliminate the row.
Not sure about the field names, I think you might need to know them in advance. Perhaps leverage a lookup table and foreach command...

just some ideas...

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...