Splunk Search
Highlighted

Is it possible to pass dynamic field name to kvstore lookup?

Communicator

Hi All,
I need to lookup a value on three different kvstore fields based on its regex format. Is it possible to pass dynamic field name to kvstore lookup?

Lets say, I have three field lookup - userid, mail, secondaryids. I want to achieve something like below.
| lookup records_lookup $arg$
- where arg would be mail if value is of email id format
- where arg would be userid if value is of aXXXXXX
- where arg would be secondaryids if value is of bXXXXXX

I am trying to avoid multiple lookup statements into my search as the lookup value can only be of one format.

0 Karma