Splunk Search

Can lookups be made conditional on the value of a field?


Is it possible to make a lookup run only when the value of a field is null or some other value?



Tags (1)

Super Champion

Basically, if you hide (or remove) the input field used your lookup, then the lookup for a specific event isn't executed because there is no value to lookup. That makes sense. You can leverage this behavior to do a conditional lookup by conditionally hiding the lookup input field before you call lookup. I think and example would be helpful.

Let's say your base lookup search looks like this:

 ... | lookup mylookup code OUTPUT desc | ...

So lookup is using the "mylookup" lookup table, "code" is the input field and the lookup returns a "desc" field.

Now, let's say you have a field called "bool" that enabled/disables this lookup. (The lookup is enabled when "bool=1"). Then you can use a search like this:

 ... | eval _copy_code=code
     | eval code=if(bool==1, code, null())
     | lookup mylookup code OUTPUT desc
     | rename _copy_code as copy
     | ...

Note: If you don't need to preserve "code" then you can drop out the first and last search commands.

The following question & answer may help too:


Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...