Splunk Search

If I use an automatic lookup to overwrite field values, can it be configured to overwrite only if a match exists?

andrewtrobec
Motivator

Hello all,
The question is self explanatory I think. I've seen similar questions that are resolved with an eval, but in my case I'm trying to make everything automatic. Since the sequence of search-time operations dictates that lookups are after calculated fields, there is no way to automatically run the eval to either validate with an if statement or coalesce. This is why I'm hoping there is a way during an automatic lookup to leave an existing value if there is no match instead of replacing with null.
Is this possible?
Thank you and best regards,
Andrew

0 Karma

JimGat
New Member

You need to use an eval after the lookup making sure that the lookup fields are a different name.    I have an example of that for an automated identity population for Enterprise Security where I created an override lookup after the LDAP query.  Here is just the lookup and eval.  

`comment("Override priority and category Values if in es_identity_override.csv")`
| lookup es_identity_override.csv identity as sAMAccountName OUTPUT category as OVcategory priority as OVpriority bunit as OVbunit
| eval category=if(isnull(OVcategory), category, OVcategory)
| eval priority=if(isnull(OVpriority), priority, OVpriority)
| eval bunit=if(isnull(OVbunit), bunit, OVbunit)
0 Karma

starcher
Influencer

outputnew instead of output

0 Karma

andrewtrobec
Motivator

@starcher Thanks for the suggestion

AFAIK the OUTPUTNEW command will only fill in NULL values. What I'm trying to do is overwrite existing values. Am I understanding correctly?

0 Karma

starcher
Influencer

I misread the issue. Yeah you have output which overwrites or outputnew only if it's not already there. So the command by itself won't solve that.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...