Best option for a filter of field = field in a record?

[canob]

Hi everyone,

I'm trying to create a filter for tag/route a record that has two identical fields, ServiceName and TargetUserName_User.

At first, I tried to do it with Stream Processing, because to my understanding, that is the simplest way, but sadly, Stream Processing don't support define a field equal to other field, like this:

[STREAM_TASK]
    Name windows_detections_sam_spoof_DC_imper
    Exec CREATE STREAM windows_detections_sam_spoof_DC_imper WITH (tag='windows_detections_sam_spoof_DC_imper') AS SELECT * FROM TAG:'windows_filters_gold_tck_krb_req_rc4_enc_sam_spoof' WHERE ServiceName = TargetUserName_User;

So, I don't know if there is a filter that can do this. Maybe LUA? But I'm not really know much about LUA, so I don't know how to do it.

Anyone with the same use case? How I can do this in the best possible way?

Thanks in advance for your help.
Regards!

[canob]

Finally I found a way. With this LUA Filter I created a field with the content "match" or "nomatch", based on compare the ServiceName with the TargetUserName (without @Domain), and after that, I can create a rewrite_tag filter based on that new field to route my message:

function string:split( inSplitPattern, outResults )
  if not outResults then
    outResults = { }
  end
  local theStart = 1
  local theSplitStart, theSplitEnd = string.find( self, inSplitPattern, theStart )
  while theSplitStart do
    table.insert( outResults, string.sub( self, theStart, theSplitStart-1 ) )
    theStart = theSplitEnd + 1
    theSplitStart, theSplitEnd = string.find( self, inSplitPattern, theStart )
  end
  table.insert( outResults, string.sub( self, theStart ) )
  return outResults
end

function cb_filter(tag, ts, record)
  local log1 = record.ServiceName
  local log2pre = record.TargetUserName:split("@")
  local log2 = log2pre[1]

  if log1 == log2 then
    record.serviceusr_targetusr = 'match'
  else
    record.serviceusr_targetusr = 'notmatch'
  end        
  
  return 1, ts, record
end