topic Re: Current logged in user in 6.3 in Security

Current logged in user in 6.3

grossb — Wed, 23 Dec 2015 22:35:40 GMT

Hello,
The current recommendations to use "| rest /services/authentication/current-context" to find the current logged in user do not work in 6.3.1. What is the alternative?

Thanks,
Brett

Re: Current logged in user in 6.3

dcarmack_splunk — Thu, 24 Dec 2015 01:54:50 GMT

Hi Brett

What specifically isn't working for you? The command works as expected for me.

Re: Current logged in user in 6.3

javiergn — Thu, 24 Dec 2015 08:43:37 GMT

Try specifying the local server:

| rest /services/authentication/current-contex splunk_server=local

Re: Current logged in user in 6.3

grossb — Thu, 24 Dec 2015 16:52:35 GMT

I kept getting "Splunk-System-User" as the username when using the command above. Adding "splunk_server=local" as noted in the answer brought the correct current logged in user.

Re: Current logged in user in 6.3

grossb — Thu, 24 Dec 2015 16:53:17 GMT

This worked for me after fixing the typo. Thank you very much!

"| rest /services/authentication/current-context splunk_server=local"