I need a way to make a lookup conditional

[bdh5574]

I have two lookup tables. Both contain a set of userid's.
The first lookup returns a name and department for 80% of the records.
The second lookup table contains the other 20% of the userid's and will return the same name and department fields.

The second lookup overlays the name and department with nulls for all records found in the first lookup.

I need to be able to only run the second lookup if the name field is null after the first lookup.

| lookup TAM_Information.csv UserID OUTPUT FULNAME as Name AD_DEPARTMENT as Department
| lookup NTACC1.userid.department.csv UserID OUTPUT NAME as Name DEPARTMENT as Department

I've searched and haven't found a solution. Can this be done?

Bob

[somesoni2 · Accepted solution]

Use OUTPUTNEW instead of OUTPUT in your lookup command. See this for more details on the two.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup#Usage

[bdh5574]

That worked like a charm. Thank you.