Developing for Splunk Enterprise
Highlighted

External lookup script is not returning values when one of the input is null

Engager

I was calling lookup in my query with two input fields and three output fields.

My query looks like
...|lookup nameslookup personid,personname OUTPUT personfirst,personlast,personmiddle

my config in transforms.conf looks like
[nameslookup]
external
cmd = nameslookupexample.py personid personname personfirst personlast personmiddle
external
type = python
fieldslist = personid, personname, personfirst, personlast, personmiddle

And my script is trying to find fisrt and last names from another csv file using the personid. If it finds a row in csv for that id return that data otherwise split the input field(personname) and put them in the output fields. return it.

So everything works except when person_name input is null or empty string the output fields were empty even though i have row in my csv file for that id.
should all input values be not null for lookup to work?
I can't modify input fields in the script.can we do that ?

0 Karma