Splunk Search

How to use inputlookup OUTPUT properly when a column is blank?

anirban_nag
Explorer

This is a follow up question with respect to this previous question - https://answers.splunk.com/answers/627286/how-to-filter-multiple-regex-condition-and-create.html

The answer for that is working for me. But it doesn't work when there is a blank value in a column for which lookup is set for.
Like even if Email contains splunk but Message is blank then it is OUTPUT as OTHER, where it is expected as Splunk in Type.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You should be doing lookup based on the column which is primary key (something that can uniquely identify your event data and lookup data. If it can be just user name (which shouldn't be blank), they do the lookup just based on that column.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @anirban_nag,

Based on previous answer, can you please try below query

your base search that gives you the first table above
| fillnull value=NULL Address UserName Email Message 
| lookup get_type Address, UserName, Email, Message OUTPUT Type
| fillnull value="Other" Type
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...