Static lookup only on results found

[sonicZ]

I have basic lookups using a static lookup table of network devices, it's looking up host values if they show up as IP as we prefer devices to display as hostname. It displays an additional fieldname "host2"

index=net earliest=-1h | lookup network_device_lookup.csv device_ip AS host OUTPUT host2

this is based on lookup table data such as

host2,device_ip
ACS-MTV,10.198.1.1
ASA.SSOPTNR-FO.MTV1,10.198.1.3
AT3.SSO-BO.ILG1,10.244.198.1.4
AT4.SSO-BO.ILG1,10.244.1.5

how can i keep the orignal field "host" on results not found in the lookup table but ovveride the original host value with a lookup only if it contains an IP from the matching lookup table?
Possible to due this with a nested eval block?

I also dont want to use dnslookups since the csv file is rather small

[somesoni2]

just rename the field name in your lookup table from host2 to host. Also update your search with this change.

[Ayn]

I'm a bit confused because this is the default behaviour. If Splunk doesn't find a match for an input value it won't write/overwrite any corresponding output values for that event either. Is the lookup really overwriting your host values for non-existing entries or was this question based on an assumption that it would?

[sonicZ]

Hi Ayn, Originally i was using the same search string using "host" in the OUTPUT host and the lookup table had entries such as:
host, device_ip
It appeared to be writing all values as "NULL" when piped to timechart instead of actually retrieving the lookup value hostname.
and i've manually verified the ip that is returned in splunk results does exist in the lookup table, wierd...