Security

Easy, native way to grab user name pushing submit button on a dashboard?

Runals
Motivator

Wasn't sure how to phrase the question. I'd like to have a dashboard a user can input information and then after hitting Submit updates a lookup. That part is easy enough. What I'd like to do, without prompting them, is behind the scene grabbing their user name and adding it to the lookup with the information they have entered. By chance has anyone done something similar before?

Tags (1)
0 Karma

LukeMurphey
Champion

The answer depends on where you want to get the information.

In search:

| rest /services/authentication/current-context splunk_server=local | fields username

In a SplunkWeb controller (Python):

import cherrypy
user = cherrypy.session['user']['name']

In a splunkd REST endpoint (Python, when inheriting from splunk.rest.BaseRestHandler):

user = self.request['userName']

In Javascript:

function getUser(){

    var uri = Splunk.util.make_url("/splunkd/__raw/services/authentication/current-context?output_mode=json");
    var info = null;

    // Fire off the request
    jQuery.ajax({
        url:     uri,
        type:    'GET',
        async:   false,
        success: function(result) {
            console.info(result);
            info = result;
        }
    });

    return info.entry[0].content.username;  
}

var user = getUser();
0 Karma

pradeepkumarg
Influencer

The better place to start is looking at splunk_web_access for this information


index=_internal sourcetype=splunk_web_access my_dashboard

The results should give you the information of the query string that is formed to execute the dashboard. With little regex, you should be able to retrieve the input information user provided, The sourcetype also has "user" field. You can then schedule a search to retrieve this information periodically and update the lookup..

0 Karma

acharlieh
Influencer

You can get the current user name through an inline search, namely |rest /services/authentication/current-context splunk_server=local

You could use append and stats tricks to add it in how you want, or even have it be a populating search on a different input for your dashboard field.

See: http://docs.splunk.com/Documentation/Splunk/6.2.1/RESTREF/RESTaccess#authentication.2Fcurrent-contex...

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...