Getting Data In

How to set empty string or null value for non-matched lookup items?

dorilevy
Path Finder

Hi,

According to the document splunk should use empty string for non-matching lookup by default. Yet, when i set an automatic lookup, i can see it uses the "NONE" string by default.

I need it to be either empty string or null(). I tried setting default (in transforms.conf file) to NULL or null() but it just sets a string with that value.

Here is how my auto-lookup is set:

props.conf:
LOOKUP-check = valid_sc_users user_id

[valid_sc_users]
filename = valid_sc_users.csv
max_matches = 1
min_matches = 1
disabled = 0

Thanks You

1 Solution

dorilevy
Path Finder

Just found out i can set the min_matches to 0, because the output field does not exists. this way nothing will be added - and that's what i needed.

View solution in original post

dorilevy
Path Finder

Just found out i can set the min_matches to 0, because the output field does not exists. this way nothing will be added - and that's what i needed.

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...