automatic lookup based on condition

[mahe90]

Hi, 

My CSV(test_csv_lookup) looks like this: 

---

index; value

1, 1.1.1.1

---- here is my automatic lookup 

LOOKUP-field_extract = test_csv_lookup index AS ip OUTPUTNEW value AS lookedup_val

I have two following events in the index for which I will apply the the above automatic lookup: 

event1 -  timestmap, 1

event2 - timestmap, 2.2.2.2. 

In above event, the "ip" field values are "1", and "2.2.2.2", in the first event, "1" being the value of the "ip" ,  just refers to the index value of the lookup table and second event just contain raw value, and doesn't need lookup. 

When I query for the index, the lookedup_val  shows the "1.1.1.1". What I need is that, both the values(in the fieldlookedup_val) , that is "1.1.1.1" and "2.2.2.2".  For the first event, its working fine, by looking up the index and able to retrieve, for the second event also it's doing the lookup and obviously it can't find.  When lookup can't find the value, could it' use the raw value or default field value, in this case, 2.2.2.2? Is there a way I can specify this in automatic lookup output?

Thanks,

[thambisetty]

you can't do that. but you can write below in your search.

| eval lookedup_val = if(isnull(lookedup_val),ip,lookedup_val)

if you think, you can add this to props.conf, it won't work because first EVAL will be executed then Lookup configuration will be executed next.

https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Searchtimeoperationssequence