How to set empty string or null value for non-matched lookup items?

[dorilevy]

Hi,

According to the document splunk should use empty string for non-matching lookup by default. Yet, when i set an automatic lookup, i can see it uses the "NONE" string by default.

I need it to be either empty string or null(). I tried setting default (in transforms.conf file) to NULL or null() but it just sets a string with that value.

Here is how my auto-lookup is set:

props.conf:
LOOKUP-check = valid_sc_users user_id

[valid_sc_users]
filename = valid_sc_users.csv
max_matches = 1
min_matches = 1
disabled = 0

Thanks You

[dorilevy · Accepted solution]

Just found out i can set the min_matches to 0, because the output field does not exists. this way nothing will be added - and that's what i needed.