How to use inputlookup OUTPUT properly when a column is blank?

[anirban_nag]

This is a follow up question with respect to this previous question - https://answers.splunk.com/answers/627286/how-to-filter-multiple-regex-condition-and-create.html

The answer for that is working for me. But it doesn't work when there is a blank value in a column for which lookup is set for.
Like even if Email contains splunk but Message is blank then it is OUTPUT as OTHER, where it is expected as Splunk in Type.

[somesoni2]

You should be doing lookup based on the column which is primary key (something that can uniquely identify your event data and lookup data. If it can be just user name (which shouldn't be blank), they do the lookup just based on that column.

[harsmarvania57]

Hi @anirban_nag,

Based on previous answer, can you please try below query

your base search that gives you the first table above
| fillnull value=NULL Address UserName Email Message 
| lookup get_type Address, UserName, Email, Message OUTPUT Type
| fillnull value="Other" Type