If I use an automatic lookup to overwrite field values, can it be configured to overwrite only if a match exists?

[andrewtrobec]

Hello all,
The question is self explanatory I think. I've seen similar questions that are resolved with an eval, but in my case I'm trying to make everything automatic. Since the sequence of search-time operations dictates that lookups are after calculated fields, there is no way to automatically run the eval to either validate with an if statement or coalesce. This is why I'm hoping there is a way during an automatic lookup to leave an existing value if there is no match instead of replacing with null.
Is this possible?
Thank you and best regards,
Andrew

[JimGat]

You need to use an eval after the lookup making sure that the lookup fields are a different name.    I have an example of that for an automated identity population for Enterprise Security where I created an override lookup after the LDAP query.  Here is just the lookup and eval.  

`comment("Override priority and category Values if in es_identity_override.csv")`
| lookup es_identity_override.csv identity as sAMAccountName OUTPUT category as OVcategory priority as OVpriority bunit as OVbunit
| eval category=if(isnull(OVcategory), category, OVcategory)
| eval priority=if(isnull(OVpriority), priority, OVpriority)
| eval bunit=if(isnull(OVbunit), bunit, OVbunit)

[starcher]

outputnew instead of output

[andrewtrobec]

@starcher Thanks for the suggestion

AFAIK the OUTPUTNEW command will only fill in NULL values. What I'm trying to do is overwrite existing values. Am I understanding correctly?

[starcher]

I misread the issue. Yeah you have output which overwrites or outputnew only if it's not already there. So the command by itself won't solve that.