Splunk Search

Is it possible to add a default value for a lookup without match?

HeinzWaescher
Motivator

Hi,

is it possible to define a default value for a lookup command when no matches are present for the given input?
I know that it works for automatic lookups. But how can I achieve it for this:

| lookup table.csv key OUTPUT result

Or do I have to use a workaround with fillnull or eval?

Thanks in advance
Heinz

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

You can do that if you create a lookup definition that uses your table.csv file. Here is an example:
alt text

Set the minimum matches to 1 and configure the 'Default Matches' to whatever value you want to return if no match is found.

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

You can do that if you create a lookup definition that uses your table.csv file. Here is an example:
alt text

Set the minimum matches to 1 and configure the 'Default Matches' to whatever value you want to return if no match is found.

HeinzWaescher
Motivator

That's what I expected, because I already used it for automatic lookups. No idea why my first try didn't work...but now it does 🙂

0 Karma

sundareshr
Legend

Try this

...  | lookup table.csv key OUTPUT result | fillnull result value="default"

FrankSPL
Path Finder

Thnx for this suggestion. Very useful, even when this is an old thread!

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...