The cleanest way to support this is probably by implementing the planned "virtual fields" in libauparse.
An alternative is to design the "virtual fields" interface and to partially implement it in audit-viewer instead of auparse.
Log in to comment on this ticket.