I have two lookup tables that may contain the hostname of an IP address
| lookup cmdb_ci_server_lookup ip_address as src output fqdn as orig_host | lookup lansweeper_assets_lookup IPAddress as src output AssetName as orig_host
However, if AssetName in lansweeperassetslookup is null, the output of orig_host will be null as well. I know I can assign them different names and do an eval to combine but was hoping to get a more elegant way. any ideas?
what exactly is the goal? to join cmdbciserverlookup to lansweeperassetslookup by ipaddress/IPAddress and fill the null values of AssetName/orighost from lansweeperassets_lookup?
the goal is to get the hostname from either lookup table. not looking to combine them, although maybe I should just do that in a different search
Which value takes precedence, once from lansweeperassetslookup OR one from cmdbciserver_lookup (assuming both returns value)?
Cool. So in your lookup command, you're using OUTPUT option to get orig_host, replace it with OUTPUTNEW.
If the OUTPUT clause is specified, the output lookup fields overwrite existing fields. If the OUTPUTNEW clause is specified, the lookup is not performed for events in which the output fields already exist.
So your queries will be like this
| lookup cmdbciserverlookup ipaddress as src outputnew fqdn as orighost
| lookup lansweeperassetslookup IPAddress as src outputnew AssetName as orighost
If you're just trying to bring in hostname and not combine the tables together, I'd use coalesce. I'd just do something like
|join src type=left [|inputlookup cmdb_ci_server_lookup|fields ip_address fqdn|rename ip_address as src] |join src type=left [|inputlookup lansweeper_assets_lookup |fields IPAddress AssetName|rename IPAddress as src] |eval orig_host=coalesce(fqdn,AssetName)