Is it possible to add a default value for a lookup without match?

[HeinzWaescher]

Hi,

is it possible to define a default value for a lookup command when no matches are present for the given input?
I know that it works for automatic lookups. But how can I achieve it for this:

| lookup table.csv key OUTPUT result

Or do I have to use a workaround with fillnull or eval?

Thanks in advance
Heinz

[s2_splunk · Accepted solution]

You can do that if you create a lookup definition that uses your table.csv file. Here is an example:

Set the minimum matches to 1 and configure the 'Default Matches' to whatever value you want to return if no match is found.

[HeinzWaescher]

That's what I expected, because I already used it for automatic lookups. No idea why my first try didn't work...but now it does 🙂

[sundareshr]

Try this

...  | lookup table.csv key OUTPUT result | fillnull result value="default"

[FrankSPL]

Thnx for this suggestion. Very useful, even when this is an old thread!