Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Lookup file : add a rule
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
Got a lookup file looking like this :
USER,GROUP
Peter,group1
Parker,group1
John,group2
Kevin,group2
I'd like to add a line at the end to make a rule "Any other users, put him in group3".
Something which would look like :
USER,GROUP
Peter,group1
Parker,group1
John,group2
Kevin,group2
ANYBODY ELSE,group3
But I'm not sure how to achieve this and haven't found my answer yet.
Thank you for your help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Zakary_n,
Have a look here they have the answer for you!
https://answers.splunk.com/answers/443145/is-it-possible-to-add-a-default-value-for-a-lookup.html
Either make an automatic lookup with a default value.
Or use a combination of lookup + eval or fillnull to backfill empty values of group with your default value like this :
... | lookup table.csv key OUTPUT result | fillnull result value="default"
Cheers,
David
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Zakary_n,
Have a look here they have the answer for you!
https://answers.splunk.com/answers/443145/is-it-possible-to-add-a-default-value-for-a-lookup.html
Either make an automatic lookup with a default value.
Or use a combination of lookup + eval or fillnull to backfill empty values of group with your default value like this :
... | lookup table.csv key OUTPUT result | fillnull result value="default"
Cheers,
David
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is what I was looking for. Thank you for the fast answer!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
most welcome @Zakary_n 😉
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
