hi - I have a look-up table of errors codes and descriptions, and a log file with errors codes
lookup error_descriptions_table look_up_errors as errors OUTPUT description | top description
This works fine if all the error codes are in the look-up table but if a new error appears in the log it will not display it (or combine them into a null field) - so what i want it to do is display the error description if possible otherwise display the code - in the same column
so if the look-up table is
200, perfect
404, page not found
500, internal server error
etc
log file is
200
200
404
700
404
800
200
etc
At the moment I get
perfect 3
null 2
not found 2
what i want is
perfect 3
not found 2
700 1
800 1
Thanks
Appending an eval after your search should do the job, something like;
| eval description=if(isnull(description),look_up_errors,description)
This basically says, set the field description equal to the look_up_errors value if the field is null (no value is returned from the lookup). Otherwise, if it isn't null then we can assume it has successfully looked up a description and instead keep using it.
That was a good answer Drainy. It worked for me too.
Appending an eval after your search should do the job, something like;
| eval description=if(isnull(description),look_up_errors,description)
This basically says, set the field description equal to the look_up_errors value if the field is null (no value is returned from the lookup). Otherwise, if it isn't null then we can assume it has successfully looked up a description and instead keep using it.
Thanks - that solved the problem 🙂