I'm doing a pretty basic search which looks for a "connection closed" message and displays a variable called app. I have an automatic lookup which converts the app value to an application name. Not all of the values can be looked up in my lookup table. How do I run a search and display the application name (app_name) and if that's not available then display the app (numeric value)?
Here is the search I have made that calculates bytes sent/received and displays bot the app name and the app numeric value.
app=* "Connection Closed" | stats sum(sent) sum(rcvd) by dst_ip app | lookup sonicwall_app_id app_id as app OUTPUT app_name as Application | fields dst_ip, Application, app, sum(sent), sum(rcvd) | rename dst_ip as "Destination IP" | rename app to "App ID" | rename sum(sent) as "Bytes Sent" | rename sum(rcvd) as "Bytes Received"