Wanted to convert a search to a drop down listing, but not certain where to place the token.

nls7010 — Thu, 21 Jun 2018 14:37:10 GMT

I found this search and it works well for the information I need. However, I have been unable to create a drop-down of the user ID so that I can display only one users information at a time:

|rest /services/authentication/users splunk_server=local
|fields title realname roles |rename title as userName|rename realname as Name

My Dropdown search is: user=* | fields user | dedup user
My Token is: myuser

What I'm having a problem with is getting the myuser in the right place in the first search, or do I need to create an additional line in the main search that I populate with the $myuser$?

Re: Wanted to convert a search to a drop down listing, but not certain where to place the token.

kmaron — Thu, 21 Jun 2018 17:11:13 GMT

|rest /services/authentication/users splunk_server=local user=$myuser$
|fields title realname roles |rename title as userName|rename realname as Name

Just add it to the filter part of your original search.

topic Wanted to convert a search to a drop down listing, but not certain where to place the token. in Splunk Search

Wanted to convert a search to a drop down listing, but not certain where to place the token.

Re: Wanted to convert a search to a drop down listing, but not certain where to place the token.