Splunk Dev

splunk way to extract records from a file looking up at the userid

madakkas
Explorer

Hi All,

I have an issue, say where in have file as below

val1 val2 val3 userid
1 a ! u1
2 b @ u1
3 c # u2
4 d $ u2
5 e % u3
6 f ^ u3
7 g & u1

So I would want to display this file in such a way that when user – u1 logs in he sees only

val1 val2 val3 userid
1 a ! u1
2 b @ u1
7 g & u1

When u2 – logs on he sees only

val1 val2 val3 userid
3 c # u2
4 d $ u2

And the below for u3

val1 val2 val3 userid
5 e % u3
6 f ^ u3

Ive tried the below , but am not able to get it working.

|Inputlookup ip_file.csv |where username = [rest splunk_server=local /services/authentication/current-context|eval user_name = username |return user_name]

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...