Splunk Search

Lookup default_match for multiple columns?

mjpieters
Explorer

We are using a CSV to map one field to two more:

status,status_title,status_type,status_ok
-,Network connection successful,Network success,Success
D,DNS lookup failure,Network failure,Failure

etc, with a lookup:

lookup network_status_codes status AS receiver_network_status OUTPUTNEW
    status_title AS network_status_title,
    status_type AS network_status_type,
    status_ok AS network_status_ok

How can I handle falling back to defaults for all three columns? The default_match field appears to only let me provide one fallback; I don't think I can use:

[network_status_codes]
filename = network_status_codes.csv
min_matches = 1
default_match = Unknown network error,Network failure,Failure

here.

Should I use a wildcard match instead? E.g. add a row:

*,Unknown network error,Network failure,Failure

then set the match type:

match_type = WILDCARD(status)

to make this work?

Tags (2)
0 Karma
1 Solution

mjpieters
Explorer

As I could not get the WILDCARD approach to work (the lookup always fails and the fields end up as NULL), I used:

 | fillnull value="Unknown network error" network_status_title 
 | fillnull value="Network Error" network_status_type 
 | fillnull value="Failure" network_status_ok 

instead in the query; e.g. when the lookup fails supply default values manually.

Although the WILDCARD should have worked (I probably didn't re-load the dataset) I've since had confirmation from Splunk that using fillnull is better from a performance point of view here.

View solution in original post

madchutney
New Member

The wildcard requires enabling in transforms.conf, e.g.

match_type = WILDCARD(status)
max_matches = 1

The max_matches stops the status matching the wildcard for known values. The lookup csv file can then have an extra entry:

*,Default title,Default type,Default ok
0 Karma

mjpieters
Explorer

As I could not get the WILDCARD approach to work (the lookup always fails and the fields end up as NULL), I used:

 | fillnull value="Unknown network error" network_status_title 
 | fillnull value="Network Error" network_status_type 
 | fillnull value="Failure" network_status_ok 

instead in the query; e.g. when the lookup fails supply default values manually.

Although the WILDCARD should have worked (I probably didn't re-load the dataset) I've since had confirmation from Splunk that using fillnull is better from a performance point of view here.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...