How to return value without match in lookup without using lookup advanced options

[katzr]

Hello,

I want to return the all of the location values in my data even if there is no match to the location in the lookup. I created a lookup table and used the advanced options to specify a default match, but for some reason I am having permission issues with my lookup table which I believe is a splunk bug.

So is there any other way to return all of my values from my data without using the default advanced options. Below is an example of my query. I want to return all of the locations even if not found in my lookup. If you would like to help me with the splunk error with my lookup table also- I can explain the problem more in detail. Thanks for the help!

    index=A | lookup TableName location | search region=*  location=*  country=*

[woodcock]

Bypass the whole matter by specifying your default manually with |eval location="Unknown" | eval country="Unknown" before you call the lookup. Any match will overwrite the value, any miss will retain it.