Splunk Dev

External lookup script is not returning values when one of the input is null

rajpannala
Engager

I was calling lookup in my query with two input fields and three output fields.

My query looks like
...|lookup names_lookup person_id,person_name OUTPUT person_first,person_last,person_middle

my config in transforms.conf looks like
[names_lookup]
external_cmd = names_lookup_example.py person_id person_name person_first person_last person_middle
external_type = python
fields_list = person_id, person_name, person_first, person_last, person_middle

And my script is trying to find fisrt and last names from another csv file using the person_id. If it finds a row in csv for that id return that data otherwise split the input field(person_name) and put them in the output fields. return it.

So everything works except when person_name input is null or empty string the output fields were empty even though i have row in my csv file for that id.
should all input values be not null for lookup to work?
I can't modify input fields in the script.can we do that ?

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...