I have two lookup tables. Both contain a set of userid's.
The first lookup returns a name and department for 80% of the records.
The second lookup table contains the other 20% of the userid's and will return the same name and department fields.
The second lookup overlays the name and department with nulls for all records found in the first lookup.
I need to be able to only run the second lookup if the name field is null after the first lookup.
| lookup TAM_Information.csv UserID OUTPUT FULNAME as Name AD_DEPARTMENT as Department
| lookup NTACC1.userid.department.csv UserID OUTPUT NAME as Name DEPARTMENT as Department
I've searched and haven't found a solution. Can this be done?
Bob
Use OUTPUTNEW instead of OUTPUT in your lookup command. See this for more details on the two.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup#Usage
Use OUTPUTNEW instead of OUTPUT in your lookup command. See this for more details on the two.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup#Usage
That worked like a charm. Thank you.