Splunk Search

I need a way to make a lookup conditional

bdh5574
New Member

I have two lookup tables. Both contain a set of userid's.
The first lookup returns a name and department for 80% of the records.
The second lookup table contains the other 20% of the userid's and will return the same name and department fields.

The second lookup overlays the name and department with nulls for all records found in the first lookup.

I need to be able to only run the second lookup if the name field is null after the first lookup.

| lookup TAM_Information.csv UserID OUTPUT FULNAME as Name AD_DEPARTMENT as Department
| lookup NTACC1.userid.department.csv UserID OUTPUT NAME as Name DEPARTMENT as Department

I've searched and haven't found a solution. Can this be done?

Bob

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Use OUTPUTNEW instead of OUTPUT in your lookup command. See this for more details on the two.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup#Usage

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Use OUTPUTNEW instead of OUTPUT in your lookup command. See this for more details on the two.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup#Usage

0 Karma

bdh5574
New Member

That worked like a charm. Thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...