https://community.splunk.com/t5/Splunk-Search/Get-the-roles-from-rest-API-and-set-to-field-in-search/m-p/441116#M191185 <P>Will this help? This will append rlss as a new column to your outside query</P> <PRE><CODE>|makeresults|appendcols [|rest /services/authentication/current-context|mvexpand roles | eval rlss="\""+roles+","+username+"\"" | fields rlss] </CODE></PRE> Fri, 09 Aug 2019 01:25:14 GMT nareshinsvu 2019-08-09T01:25:14Z https://community.splunk.com/t5/Splunk-Search/Get-the-roles-from-rest-API-and-set-to-field-in-search/m-p/441113#M191182 <P>I need to get the roles assigned to current logged in user and set the value to filed in search. Anybody has any idea. I tried the following and got the error.</P> <P>|makeresults|eval rls=[|rest /services/authentication/current-context |eval rls="\"".roles."\""|eval user="\"".username."\""|eval rlss=mvjoin(roles,",")|return $rlss]</P> <P>but got the error : Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression <BR /> not much details in logs.</P> <P>Anybody has any idea how to fix this? </P> <P>TIA.</P> Fri, 09 Aug 2019 00:00:28 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-roles-from-rest-API-and-set-to-field-in-search/m-p/441113#M191182 bhupalbobbadi 2019-08-09T00:00:28Z https://community.splunk.com/t5/Splunk-Search/Get-the-roles-from-rest-API-and-set-to-field-in-search/m-p/441114#M191183 <P>Why can't rlss be your new field? No need to makeresult and append your results to another filed again. Are you not missing few roles with your sub-query? Can you try this?</P> <PRE><CODE>|rest /services/authentication/current-context|mvexpand roles | eval rlss="\""+roles+","+username+"\"" | fields rlss </CODE></PRE> Fri, 09 Aug 2019 00:31:35 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-roles-from-rest-API-and-set-to-field-in-search/m-p/441114#M191183 nareshinsvu 2019-08-09T00:31:35Z https://community.splunk.com/t5/Splunk-Search/Get-the-roles-from-rest-API-and-set-to-field-in-search/m-p/441115#M191184 <P>Thanks Naresh, Your query producing results, but my requirement is get and assign all roles (comma separated string value) for the current user and set it to a field in main query. </P> Fri, 09 Aug 2019 00:52:09 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-roles-from-rest-API-and-set-to-field-in-search/m-p/441115#M191184 bhupalbobbadi 2019-08-09T00:52:09Z https://community.splunk.com/t5/Splunk-Search/Get-the-roles-from-rest-API-and-set-to-field-in-search/m-p/441116#M191185 <P>Will this help? This will append rlss as a new column to your outside query</P> <PRE><CODE>|makeresults|appendcols [|rest /services/authentication/current-context|mvexpand roles | eval rlss="\""+roles+","+username+"\"" | fields rlss] </CODE></PRE> Fri, 09 Aug 2019 01:25:14 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-roles-from-rest-API-and-set-to-field-in-search/m-p/441116#M191185 nareshinsvu 2019-08-09T01:25:14Z https://community.splunk.com/t5/Splunk-Search/Get-the-roles-from-rest-API-and-set-to-field-in-search/m-p/441117#M191186 <P>Alternatively if you want to do some comparisions with the subsearch, best way is to route the results to a lookup and then compare. Small example below</P> <PRE><CODE>|makeresults [|rest /services/authentication/current-context|mvexpand roles | eval rlss=+roles+","+username | fields rlss username | dedup rlss| outputlookup rlss.csv] | eval mainuser="splunk-system-user" | lookup rlss.csv username as mainuser </CODE></PRE> Fri, 09 Aug 2019 01:56:28 GMT https://community.splunk.com/t5/Splunk-Search/Get-the-roles-from-rest-API-and-set-to-field-in-search/m-p/441117#M191186 nareshinsvu 2019-08-09T01:56:28Z