Why is splunk field not populated with value from a lookup file?

[cbr654]

(1)  index=blah  Product IN (Cuteftp,Filezilla)
(2)  | rex field=Image "(?<values_Image>[^\\\\]+$)"
(3)  | lookup test.csv Image as values_Image OUTPUT Image
(4)  | eval match=if(values_Image == Image, "yes", "no")
| table _time Product Company Description ImageLoaded Image values_Image match

(1) I am searching index=blah  where "Product" = Cuteftp or Filezilla

(2) From my results I am removing everything before the last backslash, and the new field  is going to be  called "values_Image" 

(3) I am checking the "Image" column  in the lookup file (test.csv) to see if it matches "values_Image" from my Splunk results

(4) If there is a match, then I see "yes" in the match column in Splunk. If there is no match I see a "no"

The problem I have:
When match =yes the Image field in Splunk  is populated with the value from the Image field in the lookup file (test.csv) . This is good

When match=no  the  Image field in Splunk is not populated with the value from the the Image field in the lookup file (test.csv) . This is my problem

[richgalloway]

What you describe is normal.  If values_Image is not found in the lookup file then the Image field will be null.  Since values_Image=null is false, match is set to "no".

What value are you expecting to get from the lookup file?

[cbr654]

I have the lookup file populated with metadata in all the fields.  When "values_Image" is not found in the lookup I was hoping to see the entry I have in "Images" in the lookup file even though it does not match. My goals was to view the mis-match when match is set to "no"  Is this possible? Thanks you 

[richgalloway · Accepted solution]

If there is no match in the lookup file then Splunk doesn't know what to return so it returns nothing (null).

What problem are you trying to solve?