Using the cURL/API to submit an output_mode=csv
export job like this:
search .... | table fieldA fieldB
Will give a CSV payload if there are any matching events, otherwise, it will return no data at all, not even a header.
Is it possible to force the header, even if there are no matching events? I know Splunk knows what the header should be, since output_mode=xml
will return the expected fields in a <fieldOrder>
set.
Why not add a fake event at the end of each search, to never return an empty table ?
search .... | append [ | stats count | eval fieldA="null", fieldB="null" | fields - count ] | table fieldA fieldB
Thank you for the answer!
For me, your approach works, but isn't particularly scalable. I have ~ 50 queries that change frequently, and maintaining the column list in two points in the query is a bit fragile. The subsearch is also unbounded in time, so can be expensive on large indexes.
My current solution is to detect if no data was returned, then submit the query to the parsing endpoint, and extracting the fields from the reportsSearch
key. It's also fairly fragile (it depends on the last command being a table
), but it avoids the penalty of resubmitting the search.
Ideally Splunk would adjust things so that an output_mode=csv
would return the headers always, or at least expose an option for it.
Understood, if you have a support contract, you can still open an enhancement request case on the product, to request outputlookup options.