The cleanest way to support this is probably by implementing the planned "virtual fields" in libauparse.
An alternative is to design the "virtual fields" interface and to partially implement it in audit-viewer instead of auparse.
Login to comment on this ticket.