topic Re: Lookup- UnMatched Values in Getting Data In

Lookup- UnMatched Values

ashishlal82 — Fri, 01 Jul 2016 21:19:24 GMT

http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/ConfigureCSVlookups#Prefilter_large_CSV_lookup_tables

I have configured my lookup as stated in the above documentation and I am getting the result except for non matched values. how can I get non matched.

Re: Lookup- UnMatched Values

woodcock — Mon, 04 Jul 2016 19:26:15 GMT

After the lookup do this:

... | filllnull value="NotMatched" MyLookupOutputField

Re: Lookup- UnMatched Values

ashishlal82 — Tue, 05 Jul 2016 17:55:57 GMT

Thanks. filllnull value="NotMatched" MyLookupOutputField This works for values that the splunk did not realize it from the source. My .csv has 2 values "allow" and "deny". Right now I am getting "allow" for the values that match based in my automatic lookup definition, I just want the unmatch or "deny" to be added to my field when theres no match. Would a case statement with if clause would work?

Re: Lookup- UnMatched Values

sundareshr — Tue, 05 Jul 2016 20:43:41 GMT

Try this

... | eval fieldname=coalesce(fieldname, "deny")

Re: Lookup- UnMatched Values

woodcock — Wed, 06 Jul 2016 13:29:01 GMT

Like this:

... | filllnull value="deny" MyLookupOutputField