Splunk Search

validate a value base on the lookup

frankyip
Engager

I have a csv lookup table like:
item, expression
a, "value>12 AND value<14"
b, "value=1"
c, "value!=111 "
d, "value<10 OR value>100"
....

And I have the log like:
2016-09-09 13:13:13, item=a, value=13
2016-09-09 13:13:14, item=b, value=131
2016-09-09 13:13:15, item=c, value=3
2016-09-09 13:13:16, item=d, value=1

I can lookup ouput a new field called expression base on the lookup table. And I want to validate if the value in each record matches the corresponding expression. Is it possible to do that?

Thanks

Tags (1)
0 Karma

sundareshr
Legend

Try this

base search | where [| inputlookup lookup.csv | eval search="item=\"".item."\" AND ".expression | fields search]
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...