Splunk Search

Lookup and setting default values using a variable if an entry is not found in the lookup table

sandmountain
Explorer

I have the following Query:

index=obh_prod sourcetype=obh:edge:api proxy!="ow*" |
lookup blink_six_providers ProviderId as pxrq_h_x-corapi-target-id
OUTPUT ProviderId ProviderName | fillnull value=target_id ProviderId ProviderName | dedup ProviderName ProviderId | table ProviderId ProviderName

If no values are found ProviderId, ProviderName should both get the value of pxrq_h_x-corapi-target-id.

If actually now produces:

ProviderId ProviderName

pxrq_h_x-corapi-target-idpxrq_h_x-corapi-target-idIIDP06300Valiant Bank AGIIDP00761Aargauische Kantonalbank

 

 

 

If should produce the following if the xrq_h_x-corapi-target-id e.g. contains IIDP099999 and this value is not found in the lookup. How do I get the contents of the variable and  not the name of the variable itself?

 

ProviderId ProviderName
IIDP099999IIDP099999
IIDP06300Valiant Bank AGIIDP00761Aargauische Kantonalbank

 

Labels (3)
0 Karma

sandmountain
Explorer

If should produce the following if the xrq_h_x-corapi-target-id e.g. contains IIDP099999 and this value is not found in the lookup. How do I get the contents of the variable and  not the name of the variable itself?

 

ProviderId ProviderName

IIDP099999IIDP099999
IIDP06300My Bank AG
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...