Splunk Search

lookup input value null

shayhibah
Path Finder

Hey,

I am trying to work with lookup table where input contains 3 fields (A,B,C) and output is D

Lookup table structure:

ABCD
ab d

 

Here is my configuration:

props.conf:

LOOKUP-result = lookup_table A B C OUTPUT D

transform.conf:

[lookup_table]

filename...

 

When I run query where there is no field named C (for example: A=a, B=b), the returned output is "a" which is not what I expect it to be "d".

What am I missing here? How can I fix it?

Labels (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Try something like below:

LOOKUP-result = lookup_table A as A, B as B, C as C OUTPUT D

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...