I suspect that a custom function -- whether in Python or another high-level language -- would meet your loong-term needs better than attempting to build a lookup-based assignment of category. My estimate here is based largely on the fact that you say you will use both AND and OR, depending on the category, any my observation that record processing order in splunk is not guaranteed under many circumstances.
The caution I would have to underling here is that not everything which CAN be done, SHOULD be done. It might be technically feasible to write something like you request, for example, woodcock's KVstore suggestion could work. However, the order of magnitude of such a solution can rapidly get out of hand. The optimal case for this is going to n log n, but I'd expect most programmers who are posting a question like this would end up with an implementation that is less than optimal, possibly exponential. (ie, twice as many records generate four or more times as many operations.
On the other hand, a custom function would be much more testable in terms of its operation, and take up a more-or-less a straight-line order of magnitude (with roughly n log n for the number of categories) on the lookup, which is the best you can hope for.
... View more
