Dear Team
I have a splunk lookup with two fields, username and location.
The lookup is populated every time the location is US.
However, I want to see the location keeps on changing. So, I would like to write a query, which first checks if the username exists in the lookup and if it does, match the location in the event field to the lookup field.
If the location from event field doesn't match with that of lookup field, it should remove that username from the lookup.
Any ideas or suggestions would be appreciated.
