Using the cURL/API to submit an `output_mode=csv` export job like this:
`search .... | table fieldA fieldB`
will give a CSV payload if there are any matching events, otherwise it will return no data at all, not even a header.
Is it possible to force the header, even if there are no matching events? I know Splunk knows what the header should be, since `output_mode=xml` will return the expected fields in a `` set.
↧