At the top of splunk, I log in and see "Logged in as jgauthier".
Is there anyway to expose that username in a dashboard?
Very specifically, I would like to look at data specifically for the person that is logged in.
So, I can expose a dashboard (for all users) but the queries that run return results only for the user that is logged in.
Thanks!
In Splunk 5.0+ (and, I think, 4.3+) you can get the username by running the rest command to query Splunk's internals.
To add the username field to your search results, add the following:
| join [rest /services/authentication/current-context splunk_server=local | fields + username]
You can also get more details about the currently logged-in user by running this search:
| rest /services/authentication/users splunk_server=local | search [| rest /services/authentication/current-context | rename username as title | fields title]