Need Help with lookup using variable

[_-]

Hi,

I have index data as below and i have kvstores per each account which has additional info. 

Example Scenario (account numbers and corresponding kvstores: 
Index data:

AccountID	ResourceID
Account1	Resource1.1
Account1	Resource1.2
Account2	Resource2.1
Account2	Resource2.2

KVStores:

Account1_Collection

ResourceID	IP
Resource1.1	1.1.0.0
Resource1.2	1.1.1.1

Account2_Collection

ResourceID	IP
Resource2.1	2.2.0.0
Resource2.2	2.2.1.1

Required output:

AccountID	ResourceID	IP
Account1	Resource1.1	1.1.0.0
Account1	Resource1.2	1.1.1.1
Account2	Resource2.1	2.2.0.0
Account2	Resource2.2	2.2.1.1

I used approach mentioned in the answer here Solved: How to use a variable to determine which CSV looku... - Splunk Community, 

... | eval keyA=if(fieldX="value1"), fieldX, null()) | lookup lookupA keyA
    | eval keyB=if(fieldX="value2"), fieldX, null()) | lookup lookupB keyB
    | eval keyC=if(fieldX="value3"), fieldX, null()) | lookup lookupC keyC

but this approach does not make it dynamic, if i have new value and hence new lookup, i need to update the searches.. I want to make the search dynamically pick the correct lookup based on the value in event.

Thanks in advance,

SN

[bowesmana]

Unfortunately you cannot create that type of dynamic lookup as the name is always the text of the lookup, not some indirection through a field name.

You can do this sort of thing using tokens if the SPL is running in a dashboard where the lookup name can be a token, but it is not really a general solution that would work in an event stream where the lookup will be dynamic based on the event data itself.

I have a feeling I have seen this discussed on Splunk ideas, but you could always create a new idea if it does not already exist.

https://ideas.splunk.com/