Splunk Search

Can lookups be made conditional on the value of a field?


Is it possible to make a lookup run only when the value of a field is null or some other value?



Tags (1)

Super Champion

Basically, if you hide (or remove) the input field used your lookup, then the lookup for a specific event isn't executed because there is no value to lookup. That makes sense. You can leverage this behavior to do a conditional lookup by conditionally hiding the lookup input field before you call lookup. I think and example would be helpful.

Let's say your base lookup search looks like this:

 ... | lookup mylookup code OUTPUT desc | ...

So lookup is using the "mylookup" lookup table, "code" is the input field and the lookup returns a "desc" field.

Now, let's say you have a field called "bool" that enabled/disables this lookup. (The lookup is enabled when "bool=1"). Then you can use a search like this:

 ... | eval _copy_code=code
     | eval code=if(bool==1, code, null())
     | lookup mylookup code OUTPUT desc
     | rename _copy_code as copy
     | ...

Note: If you don't need to preserve "code" then you can drop out the first and last search commands.

The following question & answer may help too:


Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...