Lookup return same value if not found

[sarumjanuch]

Hi is there any way to return same value if not found in lookup table? i.e.
I have file

users.csv

code,name
100,jhon
200,jane

and for exmple when i am doing lookup and send for example code 300, i don have it in my table, and it will become NONE, but i want lookup to return 300.

Thank you.

[rmdfrb]

You can use coalesce()

From the docs:
"This function takes an arbitrary number of arguments and returns the first value that is not null."

eg:

... | lookup users.csv name as name OUTPUT code as code_lookup | eval code=coalesce(code,code_lookup)

This will leave the code field as it was if it existed in the event before, but fill it with the lookup value if it was null.

[somesoni2]

I believe its other way around

| lookup users.csv code as codeFromSearch OUTPUT name as name | eval name=coalesce(name,codeFromSearch)