Getting Data In

Lookup- UnMatched Values

ashishlal82
Explorer

http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/ConfigureCSVlookups#Prefilter_large_CSV_...

I have configured my lookup as stated in the above documentation and I am getting the result except for non matched values. how can I get non matched.

Tags (4)
0 Karma

sundareshr
Legend

Try this

... | eval fieldname=coalesce(fieldname, "deny")
0 Karma

woodcock
Esteemed Legend

After the lookup do this:

... | filllnull value="NotMatched" MyLookupOutputField
0 Karma

ashishlal82
Explorer

Thanks. filllnull value="NotMatched" MyLookupOutputField This works for values that the splunk did not realize it from the source. My .csv has 2 values "allow" and "deny". Right now I am getting "allow" for the values that match based in my automatic lookup definition, I just want the unmatch or "deny" to be added to my field when theres no match. Would a case statement with if clause would work?

0 Karma

woodcock
Esteemed Legend

Like this:

... | filllnull value="deny" MyLookupOutputField
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...