Splunk Dev

External lookup script is not returning values when one of the input is null

rajpannala
Engager

I was calling lookup in my query with two input fields and three output fields.

My query looks like
...|lookup names_lookup person_id,person_name OUTPUT person_first,person_last,person_middle

my config in transforms.conf looks like
[names_lookup]
external_cmd = names_lookup_example.py person_id person_name person_first person_last person_middle
external_type = python
fields_list = person_id, person_name, person_first, person_last, person_middle

And my script is trying to find fisrt and last names from another csv file using the person_id. If it finds a row in csv for that id return that data otherwise split the input field(person_name) and put them in the output fields. return it.

So everything works except when person_name input is null or empty string the output fields were empty even though i have row in my csv file for that id.
should all input values be not null for lookup to work?
I can't modify input fields in the script.can we do that ?

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...