Blank CSV in splunk report

Question

in splunk report, can we get at least header(column name)in attached CSV in autogenerated email, if there are no data in CSV/splunk.. eg. if no data then also it should atleast show header name..

Answer 1

If there are no results, you shouldn't be getting anything sent to you in your Alert/Scheduled Report

Why would you expect to see header rows, when they only "exist" if there are rows of data?

When you run the Report manually, you'll note when there are "no results" there are, well ... "no results"

There is no header information because there is no information

Edit to address comment "there is one requirement from client that they want atleast column name if report is blank"

You need to manually create a "blank" report, then: something similar to this should work:

index=ndx sourcetype=srctp 
| fillnull value="-" fieldA, fieldB, fieldC ...
<rest of search before stats>
| stats count by *
<rest of search>

That should mean when you eventually statsout your table, you'll have at least something "in every field" - which means you should always get at least one row (even if it's all dashes)