topic search based on logged in user id in Splunk Search

search based on logged in user id

Sriram — Wed, 25 Jan 2012 05:45:12 GMT

I need to plug in the logged in user id and build a search query. How do I accomplish this ? I see
cherrypy.session['user']['name'] command provides something similar to this. How do I incorporate this command (or something similar) in my search query.

Thanks
Sriram

Re: search based on logged in user id

bwooden — Mon, 20 Feb 2012 20:29:33 GMT

There is a sneaky way this can be accomplished out of box using macros. I can explain that further if needed. I've also just uploaded an app called 'whoami'. Let me know how it works for you or if you have any feature requests or improvement ideas.

Re: search based on logged in user id

Sriram — Tue, 27 Mar 2012 15:02:42 GMT

This worked like a charm. Thank you very much.

Re: search based on logged in user id

Sriram — Mon, 28 Sep 2020 11:50:59 GMT

I sporadically get this error for some user ids. Any ideas why I am getting these. I am not sure whether it is id related or something else.
[subsearch]: External search command 'whoami'returned error code 1.
Here is the query.
index=cc_user_summary source=list_users [| whoami fieldname=userUid | fields userUid ] | dedup displayName

Re: search based on logged in user id

Jason — Tue, 29 Jan 2013 09:55:31 GMT

You can also (in 4.3+) get this information from the rest command:

something like this will add a new username field to your events:

| join [rest /services/authentication/current-context splunk_server=local| fields + username]