topic Re: whoami doesn't support external lookup? in Splunk Search

whoami doesn't support external lookup?

soe_hlawin — Wed, 16 Oct 2013 10:37:21 GMT

I have installed the app whoami. when I use it as a command from splunkweb search, it works as expected.

But when I want to use this command inside a python script which is invoked from splunkweb search (as an automated external lookup), this returns no search_user field. Moreover, if there is any CLI session on the linux server, the whoami command is returning that user than that of the splunkweb user.

Please suggest if there is any way to let whoami know to exclusively retun only the splunkweb user.

Re: whoami doesn't support external lookup?

bwooden — Wed, 16 Oct 2013 15:29:42 GMT

The whoami app was written before the release of Splunk 4.3 for use in creating reports specific to current logged in user. When that version of Splunk introduced the rest command it obviated the need for the whoami app and I quit maintaining it.

Please use the rest command in place of the whoami custom search command going forward.

One way to use it would be to add the results to each event (one of the modes supported by whoami) using a join:

* | head 10 | join [ | rest splunk_server=local /services/authentication/current-context | rename username as auth_user_id | fields auth_user_id ]

Re: whoami doesn't support external lookup?

bwooden — Wed, 16 Oct 2013 17:52:42 GMT

This was just added to the rest command's example section: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rest#Examples

Re: whoami doesn't support external lookup?

gkanapathy — Fri, 21 Mar 2014 17:31:04 GMT

could add a note to the top of the description or docs for this app, or remove the app entirely then?

Re: whoami doesn't support external lookup?

bwooden — Fri, 21 Mar 2014 17:45:27 GMT

Good point and/or request. I've just sent a note to splunkbase admin requesting app removal.

Re: whoami doesn't support external lookup?

bwooden — Fri, 21 Mar 2014 18:31:38 GMT

App removed.