Splunk Dev

External lookup script is not returning values when one of the input is null

rajpannala
Engager

I was calling lookup in my query with two input fields and three output fields.

My query looks like
...|lookup names_lookup person_id,person_name OUTPUT person_first,person_last,person_middle

my config in transforms.conf looks like
[names_lookup]
external_cmd = names_lookup_example.py person_id person_name person_first person_last person_middle
external_type = python
fields_list = person_id, person_name, person_first, person_last, person_middle

And my script is trying to find fisrt and last names from another csv file using the person_id. If it finds a row in csv for that id return that data otherwise split the input field(person_name) and put them in the output fields. return it.

So everything works except when person_name input is null or empty string the output fields were empty even though i have row in my csv file for that id.
should all input values be not null for lookup to work?
I can't modify input fields in the script.can we do that ?

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...