Splunk Search

Is it possible to pass dynamic field name to kvstore lookup?

Murali2888
Communicator

Hi All,
I need to lookup a value on three different kvstore fields based on its regex format. Is it possible to pass dynamic field name to kvstore lookup?

Lets say, I have three field lookup - userid, mail, secondaryids. I want to achieve something like below.
| lookup records_lookup $arg$
- where arg would be mail if value is of email id format
- where arg would be userid if value is of aXXXXXX
- where arg would be secondaryids if value is of bXXXXXX

I am trying to avoid multiple lookup statements into my search as the lookup value can only be of one format.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...