Splunk Search

Lookup and setting default values using a variable if an entry is not found in the lookup table

sandmountain
Explorer

I have the following Query:

index=obh_prod sourcetype=obh:edge:api proxy!="ow*" |
lookup blink_six_providers ProviderId as pxrq_h_x-corapi-target-id
OUTPUT ProviderId ProviderName | fillnull value=target_id ProviderId ProviderName | dedup ProviderName ProviderId | table ProviderId ProviderName

If no values are found ProviderId, ProviderName should both get the value of pxrq_h_x-corapi-target-id.

If actually now produces:

ProviderId ProviderName

pxrq_h_x-corapi-target-idpxrq_h_x-corapi-target-idIIDP06300Valiant Bank AGIIDP00761Aargauische Kantonalbank

 

 

 

If should produce the following if the xrq_h_x-corapi-target-id e.g. contains IIDP099999 and this value is not found in the lookup. How do I get the contents of the variable and  not the name of the variable itself?

 

ProviderId ProviderName
IIDP099999IIDP099999
IIDP06300Valiant Bank AGIIDP00761Aargauische Kantonalbank

 

Labels (3)
0 Karma

sandmountain
Explorer

If should produce the following if the xrq_h_x-corapi-target-id e.g. contains IIDP099999 and this value is not found in the lookup. How do I get the contents of the variable and  not the name of the variable itself?

 

ProviderId ProviderName

IIDP099999IIDP099999
IIDP06300My Bank AG
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...