Splunk Search

Lookup file : add a rule

Zakary_n
Path Finder

Hello,

Got a lookup file looking like this :

USER,GROUP
Peter,group1
Parker,group1
John,group2
Kevin,group2

I'd like to add a line at the end to make a rule "Any other users, put him in group3".

Something which would look like :

USER,GROUP
Peter,group1
Parker,group1
John,group2
Kevin,group2
ANYBODY ELSE,group3

But I'm not sure how to achieve this and haven't found my answer yet.

Thank you for your help.

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @Zakary_n,

Have a look here they have the answer for you!

https://answers.splunk.com/answers/443145/is-it-possible-to-add-a-default-value-for-a-lookup.html

Either make an automatic lookup with a default value.

Or use a combination of lookup + eval or fillnull to backfill empty values of group with your default value like this :

...  | lookup table.csv key OUTPUT result | fillnull result value="default"

Cheers,
David

View solution in original post

DavidHourani
Super Champion

Hi @Zakary_n,

Have a look here they have the answer for you!

https://answers.splunk.com/answers/443145/is-it-possible-to-add-a-default-value-for-a-lookup.html

Either make an automatic lookup with a default value.

Or use a combination of lookup + eval or fillnull to backfill empty values of group with your default value like this :

...  | lookup table.csv key OUTPUT result | fillnull result value="default"

Cheers,
David

Zakary_n
Path Finder

This is what I was looking for. Thank you for the fast answer!

0 Karma

DavidHourani
Super Champion

most welcome @Zakary_n 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...