https://community.splunk.com/t5/Getting-Data-In/How-to-set-empty-string-or-null-value-for-non-matched-lookup/m-p/178584#M35811 <P>Hi,</P> <P>According to the document splunk should use empty string for non-matching lookup by default. Yet, when i set an automatic lookup, i can see it uses the "NONE" string by default.</P> <P>I need it to be either empty string or null(). I tried setting default (in transforms.conf file) to NULL or null() but it just sets a string with that value. </P> <P>Here is how my auto-lookup is set:</P> <P>props.conf:<BR /> LOOKUP-check = valid_sc_users user_id</P> <P>[valid_sc_users]<BR /> filename = valid_sc_users.csv<BR /> max_matches = 1<BR /> min_matches = 1<BR /> disabled = 0</P> <P>Thanks You</P> Mon, 28 Sep 2020 17:59:22 GMT dorilevy 2020-09-28T17:59:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-empty-string-or-null-value-for-non-matched-lookup/m-p/178584#M35811 <P>Hi,</P> <P>According to the document splunk should use empty string for non-matching lookup by default. Yet, when i set an automatic lookup, i can see it uses the "NONE" string by default.</P> <P>I need it to be either empty string or null(). I tried setting default (in transforms.conf file) to NULL or null() but it just sets a string with that value. </P> <P>Here is how my auto-lookup is set:</P> <P>props.conf:<BR /> LOOKUP-check = valid_sc_users user_id</P> <P>[valid_sc_users]<BR /> filename = valid_sc_users.csv<BR /> max_matches = 1<BR /> min_matches = 1<BR /> disabled = 0</P> <P>Thanks You</P> Mon, 28 Sep 2020 17:59:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-empty-string-or-null-value-for-non-matched-lookup/m-p/178584#M35811 dorilevy 2020-09-28T17:59:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-empty-string-or-null-value-for-non-matched-lookup/m-p/178585#M35812 <P>Just found out i can set the min_matches to 0, because the output field does not exists. this way nothing will be added - and that's what i needed.</P> Mon, 03 Nov 2014 13:08:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-empty-string-or-null-value-for-non-matched-lookup/m-p/178585#M35812 dorilevy 2014-11-03T13:08:35Z