This is a follow up question with respect to this previous question - https://answers.splunk.com/answers/627286/how-to-filter-multiple-regex-condition-and-create.html
The answer for that is working for me. But it doesn't work when there is a blank value in a column for which lookup is set for.
Like even if Email
contains splunk
but Message
is blank then it is OUTPUT
as OTHER
, where it is expected as Splunk
in Type
.
You should be doing lookup based on the column which is primary key (something that can uniquely identify your event data and lookup data. If it can be just user name (which shouldn't be blank), they do the lookup just based on that column.
Hi @anirban_nag,
Based on previous answer, can you please try below query
your base search that gives you the first table above
| fillnull value=NULL Address UserName Email Message
| lookup get_type Address, UserName, Email, Message OUTPUT Type
| fillnull value="Other" Type