Displaying 'Unknown' when Lookup fail to find a match

DotTest37 — Mon, 23 May 2011 15:36:52 GMT

I have an Automatic Lookup working just fine.
Some of the values Im matching doesn't exist yet on the CSV table (they are populated once a day).
Is there any way to display UNKNOWN as a value for the field when the lookup doesnt exist on the table?
For example, if my csv lookup table looks like:
Name -- SSN

And Sometimes I dont have the Name for a SSN until the next day, so I need to mark the field as 'Unknown' when the search returns a SSN that I dont have match for the name yet.

Thanks!

Re: Displaying 'Unknown' when Lookup fail to find a match

carmackd — Mon, 23 May 2011 15:45:14 GMT

Manager >> Lookups >> Lookup Definition >>

check the advanced options checkbox

In the Minimum matches text box add:
1

In the Default matches text box add:
UNKNOWN

then save

topic Displaying 'Unknown' when Lookup fail to find a match in Splunk Search

Displaying 'Unknown' when Lookup fail to find a match

Re: Displaying 'Unknown' when Lookup fail to find a match