Splunk Search
Highlighted

Is it possible to add a default value for a lookup without match?

Motivator

Hi,

is it possible to define a default value for a lookup command when no matches are present for the given input?
I know that it works for automatic lookups. But how can I achieve it for this:

| lookup table.csv key OUTPUT result

Or do I have to use a workaround with fillnull or eval?

Thanks in advance
Heinz

0 Karma
Highlighted

Re: Is it possible to add a default value for a lookup without match?

Legend

Try this

...  | lookup table.csv key OUTPUT result | fillnull result value="default"
Highlighted

Re: Is it possible to add a default value for a lookup without match?

Path Finder

Thnx for this suggestion. Very useful, even when this is an old thread!

0 Karma
Highlighted

Re: Is it possible to add a default value for a lookup without match?

Splunk Employee
Splunk Employee

You can do that if you create a lookup definition that uses your table.csv file. Here is an example:
alt text

Set the minimum matches to 1 and configure the 'Default Matches' to whatever value you want to return if no match is found.

View solution in original post

Highlighted

Re: Is it possible to add a default value for a lookup without match?

Motivator

That's what I expected, because I already used it for automatic lookups. No idea why my first try didn't work...but now it does 🙂

0 Karma