The current recommendations to use "| rest /services/authentication/current-context" to find the current logged in user do not work in 6.3.1. What is the alternative?
Try specifying the local server:
| rest /services/authentication/current-contex splunk_server=local
View solution in original post
This worked for me after fixing the typo. Thank you very much!
"| rest /services/authentication/current-context splunk_server=local"
What specifically isn't working for you? The command works as expected for me.
I kept getting "Splunk-System-User" as the username when using the command above. Adding "splunk_server=local" as noted in the answer brought the correct current logged in user.