How to Capture Both Matched and Unmatched Events After a Lookup Filter

krishna1 — Tue, 05 Nov 2024 15:13:50 GMT

I'm working with a query where I'm using a lookup to enrich events based on the work_queue field and then filtering to pass forward only those events with a matching entry in the lookup file.

Here’s a simplified version of my query:

index="acn_ticket_summary" | lookup Master.csv "AssignmentGroup" as work_queue outputnew Desk_Ind, cdl_gs, Support_Team | where isnotnull(work_queue)

This filters the events, keeping only those that have a non-null work_queue after the lookup.

Requirement: I also need to capture the events that don’t match (i.e., those that result in isnull(work_queue)) for separate calculations. Is there a way to modify my query to keep both the matched and unmatched events?

Thank you in advance for your help!

Re: How to Capture Both Matched and Unmatched Events After a Lookup Filter

gcusello — Tue, 05 Nov 2024 07:09:41 GMT

Hi @krishna1 ,

you have only to remove the filter (where command).

Eventually, you could add a calculation (eval command) to indicate if an event is matching or not, but probably isn't relevant because the matching ones have a value in the work_queue field.

Ciao.

Giuseppe

topic Re: How to Capture Both Matched and Unmatched Events After a Lookup Filter in Splunk Search

How to Capture Both Matched and Unmatched Events After a Lookup Filter

Re: How to Capture Both Matched and Unmatched Events After a Lookup Filter