Splunk Dev

splunk way to extract records from a file looking up at the userid

madakkas
Explorer

Hi All,

I have an issue, say where in have file as below

val1 val2 val3 userid
1 a ! u1
2 b @ u1
3 c # u2
4 d $ u2
5 e % u3
6 f ^ u3
7 g & u1

So I would want to display this file in such a way that when user – u1 logs in he sees only

val1 val2 val3 userid
1 a ! u1
2 b @ u1
7 g & u1

When u2 – logs on he sees only

val1 val2 val3 userid
3 c # u2
4 d $ u2

And the below for u3

val1 val2 val3 userid
5 e % u3
6 f ^ u3

Ive tried the below , but am not able to get it working.

|Inputlookup ip_file.csv |where username = [rest splunk_server=local /services/authentication/current-context|eval user_name = username |return user_name]

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...