Splunk Search

Is it possible to fill in default values for lookup value not found

Maycockk
Explorer

Hello fellow Splunk users,

I understand it is possible to default in a single value in the event a lookup is not found.

In my case I have a CSV where we lookup a TenantId, if its found we retrieve Tenant Name, latitude and longitude for geostats purposes. What I'd like to do return a default name, latitude and longitude in the event a lookup doesn't match a TenantId in our lookup. 

All help appreciated.

Thx in advance.

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

@Maycockk,

You can add "fillnull" command after your lookup like below.

| fillnull value="Default Tenant" "Tenant Name"
| fillnull value=41.008240 latitude
| fillnull value=28.978359 longitude

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

@Maycockk,

You can add "fillnull" command after your lookup like below.

| fillnull value="Default Tenant" "Tenant Name"
| fillnull value=41.008240 latitude
| fillnull value=28.978359 longitude

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

Maycockk
Explorer

Thank you kindly, have accepted as solution. Not back to the office till early Jan but this should do the trick just perfect.

Will default the null ones to somewhere on the map that won't. Are sense so can isolate and fix lookup accordingly. As new Tenants come on board they'll naturally appear in the search results but lookup will always be playing catchup and don't want it to start failing each time.

Appreciate it!!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...