Splunk Dev

splunk way to extract records from a file looking up at the userid

madakkas
Explorer

Hi All,

I have an issue, say where in have file as below

val1 val2 val3 userid
1 a ! u1
2 b @ u1
3 c # u2
4 d $ u2
5 e % u3
6 f ^ u3
7 g & u1

So I would want to display this file in such a way that when user – u1 logs in he sees only

val1 val2 val3 userid
1 a ! u1
2 b @ u1
7 g & u1

When u2 – logs on he sees only

val1 val2 val3 userid
3 c # u2
4 d $ u2

And the below for u3

val1 val2 val3 userid
5 e % u3
6 f ^ u3

Ive tried the below , but am not able to get it working.

|Inputlookup ip_file.csv |where username = [rest splunk_server=local /services/authentication/current-context|eval user_name = username |return user_name]

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...