topic Re: lookup table to show values that do not match in Splunk Search

lookup table to show values that do not match

stephen123 — Mon, 28 Sep 2020 12:49:06 GMT

hi - I have a look-up table of errors codes and descriptions, and a log file with errors codes

lookup error_descriptions_table look_up_errors as errors OUTPUT description | top description

This works fine if all the error codes are in the look-up table but if a new error appears in the log it will not display it (or combine them into a null field) - so what i want it to do is display the error description if possible otherwise display the code - in the same column

so if the look-up table is

200, perfect

404, page not found

500, internal server error

etc

log file is

200

404

700

404

800

200

etc

At the moment I get

perfect 3

null 2

not found 2

what i want is

perfect 3

not found 2

700 1

800 1

Thanks

Re: lookup table to show values that do not match

Drainy — Mon, 28 Sep 2020 12:49:08 GMT

Appending an eval after your search should do the job, something like;

| eval description=if(isnull(description),look_up_errors,description)

This basically says, set the field description equal to the look_up_errors value if the field is null (no value is returned from the lookup). Otherwise, if it isn't null then we can assume it has successfully looked up a description and instead keep using it.

Re: lookup table to show values that do not match

stephen123 — Mon, 19 Nov 2012 11:52:19 GMT

Thanks - that solved the problem 🙂

Re: lookup table to show values that do not match

anwarmian — Thu, 27 Jun 2013 17:45:16 GMT

That was a good answer Drainy. It worked for me too.