Splunk Dev

External lookup script is not returning values when one of the input is null

rajpannala
Engager

I was calling lookup in my query with two input fields and three output fields.

My query looks like
...|lookup names_lookup person_id,person_name OUTPUT person_first,person_last,person_middle

my config in transforms.conf looks like
[names_lookup]
external_cmd = names_lookup_example.py person_id person_name person_first person_last person_middle
external_type = python
fields_list = person_id, person_name, person_first, person_last, person_middle

And my script is trying to find fisrt and last names from another csv file using the person_id. If it finds a row in csv for that id return that data otherwise split the input field(person_name) and put them in the output fields. return it.

So everything works except when person_name input is null or empty string the output fields were empty even though i have row in my csv file for that id.
should all input values be not null for lookup to work?
I can't modify input fields in the script.can we do that ?

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...