Splunk Dev

splunk way to extract records from a file looking up at the userid

madakkas
Explorer

Hi All,

I have an issue, say where in have file as below

val1 val2 val3 userid
1 a ! u1
2 b @ u1
3 c # u2
4 d $ u2
5 e % u3
6 f ^ u3
7 g & u1

So I would want to display this file in such a way that when user – u1 logs in he sees only

val1 val2 val3 userid
1 a ! u1
2 b @ u1
7 g & u1

When u2 – logs on he sees only

val1 val2 val3 userid
3 c # u2
4 d $ u2

And the below for u3

val1 val2 val3 userid
5 e % u3
6 f ^ u3

Ive tried the below , but am not able to get it working.

|Inputlookup ip_file.csv |where username = [rest splunk_server=local /services/authentication/current-context|eval user_name = username |return user_name]

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...