Splunk Search

lookup input value null

shayhibah
Path Finder

Hey,

I am trying to work with lookup table where input contains 3 fields (A,B,C) and output is D

Lookup table structure:

ABCD
ab d

 

Here is my configuration:

props.conf:

LOOKUP-result = lookup_table A B C OUTPUT D

transform.conf:

[lookup_table]

filename...

 

When I run query where there is no field named C (for example: A=a, B=b), the returned output is "a" which is not what I expect it to be "d".

What am I missing here? How can I fix it?

Labels (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Try something like below:

LOOKUP-result = lookup_table A as A, B as B, C as C OUTPUT D

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...