Per-user initial values for a shared dashboard?

[unitedmarsupial]

We've created some shared dashboards we like, but different people would prefer different initial values for some of the inputs (like time-range).

Is it possible for the initial value to be different depending on the logged-in user's name?

[woodcock]

Yes, have a base search that nothing uses like this:

| rest/services/authentication/current-context splunk_server=local
| table username realname email

Then have a done section like this:

<condition match="$result.username$==&quot;some_username_here&quot;">
    <set token="init_token_here">value for some user</set>
</condition>
<condition match="$result.username$==&quot;other_username_here&quot;">
    <set token="init_token_here">value for other user</set>
</condition>
<condition>
    <set token="init_token_here">default value here</set>
</condition>

[niketn · Accepted solution]

@unitedmarsupials refer to one of my older answers on similar lines which finds out current logged in user and loads config for the same. I have used lookup in the example for Simplicity but ideally KV Store should be used: https://answers.splunk.com/answers/682893/creating-an-about-this-dashboard-popup-modal-view.html

[spammenot66]

Just a thought, I would recommend creating and using the kv store to update and retain all settings by user

[mydog8it]

I suppose you could run a search to return the current logged on user something like this:
index=_internal [ rest /services/authentication/current-context/context splunk_server=local| fields + username | rename username as user ]
Then do a lookup for the user on a lookup table where you store all the variable settings for the dashboard and finally run the query to produce the data for the dashboard.

[unitedmarsupial]

Can the default value for a dashboard input be expressed like this -- as a result of a search?

[mydog8it]

I guess it might not change the default value, technically, but it would run the search with the users desired values, as if it was a default.
A better search for the current logged on user:
| rest /services/authentication/current-context splunk_server=local
username is the field you would use to perform the lookup...