@unitedmarsupials refer to one of my older answers on similar lines which finds out current logged in user and loads config for the same. I have used lookup in the example for Simplicity but ideally KV Store should be used: https://answers.splunk.com/answers/682893/creating-an-about-this-dashboard-popup-modal-view.html
Yes, have a base search
that nothing uses like this:
| rest/services/authentication/current-context splunk_server=local
| table username realname email
Then have a done
section like this:
<condition match="$result.username$=="some_username_here"">
<set token="init_token_here">value for some user</set>
</condition>
<condition match="$result.username$=="other_username_here"">
<set token="init_token_here">value for other user</set>
</condition>
<condition>
<set token="init_token_here">default value here</set>
</condition>
@unitedmarsupials refer to one of my older answers on similar lines which finds out current logged in user and loads config for the same. I have used lookup in the example for Simplicity but ideally KV Store should be used: https://answers.splunk.com/answers/682893/creating-an-about-this-dashboard-popup-modal-view.html
Just a thought, I would recommend creating and using the kv store to update and retain all settings by user
I suppose you could run a search to return the current logged on user something like this:
index=_internal [ rest /services/authentication/current-context/context splunk_server=local| fields + username | rename username as user ]
Then do a lookup for the user on a lookup table where you store all the variable settings for the dashboard and finally run the query to produce the data for the dashboard.
Can the default value for a dashboard input be expressed like this -- as a result of a search?
I guess it might not change the default value, technically, but it would run the search with the users desired values, as if it was a default.
A better search for the current logged on user:
| rest /services/authentication/current-context splunk_server=local
username is the field you would use to perform the lookup...