Getting Data In

How to set empty string or null value for non-matched lookup items?

dorilevy
Path Finder

Hi,

According to the document splunk should use empty string for non-matching lookup by default. Yet, when i set an automatic lookup, i can see it uses the "NONE" string by default.

I need it to be either empty string or null(). I tried setting default (in transforms.conf file) to NULL or null() but it just sets a string with that value.

Here is how my auto-lookup is set:

props.conf:
LOOKUP-check = valid_sc_users user_id

[valid_sc_users]
filename = valid_sc_users.csv
max_matches = 1
min_matches = 1
disabled = 0

Thanks You

1 Solution

dorilevy
Path Finder

Just found out i can set the min_matches to 0, because the output field does not exists. this way nothing will be added - and that's what i needed.

View solution in original post

dorilevy
Path Finder

Just found out i can set the min_matches to 0, because the output field does not exists. this way nothing will be added - and that's what i needed.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...