Splunk Search

Match records based on a WHERE condition defined in a lookup table

edoardo_vicendo
Communicator

Hello,

Suppose I have raw records like this:

 

user=blabla,org_L1=12345,org_L2=777,department=7890
user=testtt,org_L1=34567,org_L2=999,department=8910
...

 

And I would like to extract the records based on the rules defined in a lookup:

 

where_condition,role
org_L1=12345 AND org_L2=777,superuser
org_L1=34567 OR org_L2=999,normaluser

 

Is it feasible in some way to introduce into the SPL statement a "where condition" based on the where_condition field defined in the lookup?

searchmatch command could be used but it does not accept fields, it only accepts strings.

Thanks a lot,

Edoardo

Labels (2)
0 Karma