Splunk Search

lookup input value null

shayhibah
Path Finder

Hey,

I am trying to work with lookup table where input contains 3 fields (A,B,C) and output is D

Lookup table structure:

ABCD
ab d

 

Here is my configuration:

props.conf:

LOOKUP-result = lookup_table A B C OUTPUT D

transform.conf:

[lookup_table]

filename...

 

When I run query where there is no field named C (for example: A=a, B=b), the returned output is "a" which is not what I expect it to be "d".

What am I missing here? How can I fix it?

Labels (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Try something like below:

LOOKUP-result = lookup_table A as A, B as B, C as C OUTPUT D

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...