Getting Data In

Is it possible to force CSV header in export job with output_mode=csv and no matching events?

iroddis
New Member

Using the cURL/API to submit an output_mode=csv export job like this:

search .... | table fieldA fieldB

Will give a CSV payload if there are any matching events, otherwise, it will return no data at all, not even a header.

Is it possible to force the header, even if there are no matching events? I know Splunk knows what the header should be, since output_mode=xml will return the expected fields in a <fieldOrder> set.

0 Karma

yannK
Splunk Employee
Splunk Employee

Why not add a fake event at the end of each search, to never return an empty table ?

search ....  | append [ | stats count | eval fieldA="null", fieldB="null" | fields - count ]  | table fieldA fieldB
0 Karma

iroddis
New Member

Thank you for the answer!

For me, your approach works, but isn't particularly scalable. I have ~ 50 queries that change frequently, and maintaining the column list in two points in the query is a bit fragile. The subsearch is also unbounded in time, so can be expensive on large indexes.

My current solution is to detect if no data was returned, then submit the query to the parsing endpoint, and extracting the fields from the reportsSearch key. It's also fairly fragile (it depends on the last command being a table), but it avoids the penalty of resubmitting the search.

Ideally Splunk would adjust things so that an output_mode=csv would return the headers always, or at least expose an option for it.

0 Karma

yannK
Splunk Employee
Splunk Employee

Understood, if you have a support contract, you can still open an enhancement request case on the product, to request outputlookup options.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...