Lookup file : add a rule

[Zakary_n]

Hello,

Got a lookup file looking like this :

USER,GROUP
Peter,group1
Parker,group1
John,group2
Kevin,group2

I'd like to add a line at the end to make a rule "Any other users, put him in group3".

Something which would look like :

USER,GROUP
Peter,group1
Parker,group1
John,group2
Kevin,group2
ANYBODY ELSE,group3

But I'm not sure how to achieve this and haven't found my answer yet.

Thank you for your help.

[DavidHourani · Accepted solution]

Hi @Zakary_n,

Have a look here they have the answer for you!

https://answers.splunk.com/answers/443145/is-it-possible-to-add-a-default-value-for-a-lookup.html

Either make an automatic lookup with a default value.

Or use a combination of lookup + eval or fillnull to backfill empty values of group with your default value like this :

...  | lookup table.csv key OUTPUT result | fillnull result value="default"

Cheers,
David

[Zakary_n]

This is what I was looking for. Thank you for the fast answer!

[DavidHourani]

most welcome @Zakary_n 😉