topic Re: Lookup return same value if not found in Splunk Search

Lookup return same value if not found

sarumjanuch — Wed, 13 Nov 2013 14:48:10 GMT

Hi is there any way to return same value if not found in lookup table? i.e.
I have file

users.csv

code,name
100,jhon
200,jane

and for exmple when i am doing lookup and send for example code 300, i don have it in my table, and it will become NONE, but i want lookup to return 300.

Thank you.

Re: Lookup return same value if not found

rmdfrb — Wed, 13 Nov 2013 15:10:43 GMT

You can use coalesce()

From the docs:
"This function takes an arbitrary number of arguments and returns the first value that is not null."

eg:

... | lookup users.csv name as name OUTPUT code as code_lookup | eval code=coalesce(code,code_lookup)

This will leave the code field as it was if it existed in the event before, but fill it with the lookup value if it was null.

Re: Lookup return same value if not found

somesoni2 — Wed, 13 Nov 2013 16:30:43 GMT

I believe its other way around

| lookup users.csv code as codeFromSearch OUTPUT name as name | eval name=coalesce(name,codeFromSearch)