https://community.splunk.com/t5/Splunk-Search/problem-with-lookup-command/m-p/54069#M13198 <P>Hi,</P> <P>I have a master .csv file in which I have 10 rows, now I have one more child file which contains only 4 rows, now I want to lookup with the 4 rows in the 10 rows , if found, replace one of the column in master file</P> <P>in my child.csv , only two columns "A" and "B"<BR /> in my master.csv, many columns, "A","B","C","D"</P> <P>I have to match child.csv column "A" with master.csv column "A" and replace the value of column "B" of master.csv with the value of column "B" of child.csv</P> <P>|inputlookup "masterfile.csv"|....| lookup "child.csv" field_name</P> <P>but in this case what is happening is , value is getting replaced for the matched data but other values are becoming null</P> <P>I dont want that value to become null, unmatched value will remain same, only matched value will replace</P> Thu, 07 Mar 2013 08:38:16 GMT abhayneilam 2013-03-07T08:38:16Z https://community.splunk.com/t5/Splunk-Search/problem-with-lookup-command/m-p/54069#M13198 <P>Hi,</P> <P>I have a master .csv file in which I have 10 rows, now I have one more child file which contains only 4 rows, now I want to lookup with the 4 rows in the 10 rows , if found, replace one of the column in master file</P> <P>in my child.csv , only two columns "A" and "B"<BR /> in my master.csv, many columns, "A","B","C","D"</P> <P>I have to match child.csv column "A" with master.csv column "A" and replace the value of column "B" of master.csv with the value of column "B" of child.csv</P> <P>|inputlookup "masterfile.csv"|....| lookup "child.csv" field_name</P> <P>but in this case what is happening is , value is getting replaced for the matched data but other values are becoming null</P> <P>I dont want that value to become null, unmatched value will remain same, only matched value will replace</P> Thu, 07 Mar 2013 08:38:16 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-lookup-command/m-p/54069#M13198 abhayneilam 2013-03-07T08:38:16Z https://community.splunk.com/t5/Splunk-Search/problem-with-lookup-command/m-p/54070#M13199 <P>Hello,</P> <P>Can you tried to use the "join type=left" yet?</P> <P>The idea I have is something like:</P> <P>|inputlookup "masterfile.csv"| join type=left A [| inputlookup "child.csv" | rename B as B_new]| eval B = if(isnotnull(B_new), B_new, B)| outputlookup "masterfile.csv"</P> <P>Hope it helps.<BR /> Regards,<BR /> Olivier </P> Mon, 28 Sep 2020 13:27:48 GMT https://community.splunk.com/t5/Splunk-Search/problem-with-lookup-command/m-p/54070#M13199 OL 2020-09-28T13:27:48Z