Is it possible to fill in default values for lookup value not found

[Maycockk]

Hello fellow Splunk users,

I understand it is possible to default in a single value in the event a lookup is not found.

In my case I have a CSV where we lookup a TenantId, if its found we retrieve Tenant Name, latitude and longitude for geostats purposes. What I'd like to do return a default name, latitude and longitude in the event a lookup doesn't match a TenantId in our lookup. 

All help appreciated.

Thx in advance.

[scelikok · Accepted solution]

@Maycockk,

You can add "fillnull" command after your lookup like below.

| fillnull value="Default Tenant" "Tenant Name"
| fillnull value=41.008240 latitude
| fillnull value=28.978359 longitude

[Maycockk]

Thank you kindly, have accepted as solution. Not back to the office till early Jan but this should do the trick just perfect.

Will default the null ones to somewhere on the map that won't. Are sense so can isolate and fix lookup accordingly. As new Tenants come on board they'll naturally appear in the search results but lookup will always be playing catchup and don't want it to start failing each time.

Appreciate it!!