Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Lookup file : add a rule
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
Got a lookup file looking like this :
USER,GROUP
Peter,group1
Parker,group1
John,group2
Kevin,group2
I'd like to add a line at the end to make a rule "Any other users, put him in group3".
Something which would look like :
USER,GROUP
Peter,group1
Parker,group1
John,group2
Kevin,group2
ANYBODY ELSE,group3
But I'm not sure how to achieve this and haven't found my answer yet.
Thank you for your help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Zakary_n,
Have a look here they have the answer for you!
https://answers.splunk.com/answers/443145/is-it-possible-to-add-a-default-value-for-a-lookup.html
Either make an automatic lookup with a default value.
Or use a combination of lookup + eval or fillnull to backfill empty values of group with your default value like this :
... | lookup table.csv key OUTPUT result | fillnull result value="default"
Cheers,
David
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Zakary_n,
Have a look here they have the answer for you!
https://answers.splunk.com/answers/443145/is-it-possible-to-add-a-default-value-for-a-lookup.html
Either make an automatic lookup with a default value.
Or use a combination of lookup + eval or fillnull to backfill empty values of group with your default value like this :
... | lookup table.csv key OUTPUT result | fillnull result value="default"
Cheers,
David
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is what I was looking for. Thank you for the fast answer!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
most welcome @Zakary_n 😉
September Community Champions: A Shoutout to Our Contributors!
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
What’s New in Splunk Observability – September 2025
