https://community.splunk.com/t5/Splunk-Search/I-am-writing-a-subsearch-to-get-a-user-details-as-input-for/m-p/457865#M171276 <P>Bit difficult to understand your requirement, but if you try this , is the first part of your need achieved?<BR /> index=_internal | join user type=inner<BR /> [| rest /services/authentication/current-context splunk_server=local | fields username | rename username as user |top user limit=1 <BR /> | fields user]</P> Wed, 30 Sep 2020 00:29:53 GMT Sukisen1981 2020-09-30T00:29:53Z https://community.splunk.com/t5/Splunk-Search/I-am-writing-a-subsearch-to-get-a-user-details-as-input-for/m-p/457862#M171273 <P>index=* [search index=_internal [| rest /services/authentication/current-context splunk_server=local | fields username | rename username as user ] |top user limit=1 | fields user ]</P> Wed, 30 Sep 2020 00:32:57 GMT https://community.splunk.com/t5/Splunk-Search/I-am-writing-a-subsearch-to-get-a-user-details-as-input-for/m-p/457862#M171273 arunsundarm 2020-09-30T00:32:57Z https://community.splunk.com/t5/Splunk-Search/I-am-writing-a-subsearch-to-get-a-user-details-as-input-for/m-p/457863#M171274 <P>"index=* [search index=_internal [| rest /services/authentication/current-context splunk_server=local | fields username | rename username as user ] |top user limit=1 | fields user ] "</P> Wed, 30 Sep 2020 00:33:00 GMT https://community.splunk.com/t5/Splunk-Search/I-am-writing-a-subsearch-to-get-a-user-details-as-input-for/m-p/457863#M171274 arunsundarm 2020-09-30T00:33:00Z https://community.splunk.com/t5/Splunk-Search/I-am-writing-a-subsearch-to-get-a-user-details-as-input-for/m-p/457864#M171275 <P>do you have non-internal indexes with a field named called user that would match the username of the user running this? the subsearch seems to work for me when I just look at internal logs.</P> Mon, 13 May 2019 15:41:19 GMT https://community.splunk.com/t5/Splunk-Search/I-am-writing-a-subsearch-to-get-a-user-details-as-input-for/m-p/457864#M171275 maciep 2019-05-13T15:41:19Z https://community.splunk.com/t5/Splunk-Search/I-am-writing-a-subsearch-to-get-a-user-details-as-input-for/m-p/457865#M171276 <P>Bit difficult to understand your requirement, but if you try this , is the first part of your need achieved?<BR /> index=_internal | join user type=inner<BR /> [| rest /services/authentication/current-context splunk_server=local | fields username | rename username as user |top user limit=1 <BR /> | fields user]</P> Wed, 30 Sep 2020 00:29:53 GMT https://community.splunk.com/t5/Splunk-Search/I-am-writing-a-subsearch-to-get-a-user-details-as-input-for/m-p/457865#M171276 Sukisen1981 2020-09-30T00:29:53Z