How to add the user who is performing a search as an event field

[responsys_cm]

We use some lookup tables to whitelist and blacklist events by src_ip. I've created a view that allows a user to input a src_ip and have that added to the lookup table. The search looks like:

index="logentry" | head 1 | eval src_ip=$src_ip$ | eval status="blacklisted" | eval comment=$c
omment$ | inputlookup append=t ip_blacklist_lookup.csv | dedup src_ip | table src_ip,status,commen
t | outputlookup ip_blacklist_lookup.csv

Is it possible to automatically append the user who executes the search as a field in the data? I'd rather that users not have to enter (or fail to enter) their username.

Can a view run a search on load like a dashboard can? I suppose I could search the _internal index on page load for the most recent event of that page loading and get the username there. Would that require giving the user access to the _internal index or could the view run that search as Splunk itself?

Thx.

Craig

[Ayn]

You could grab the current username from the REST endpoint authentication/current-context using the rest command.

index="logentry" | head 1 | eval src_ip=$src_ip$ | eval status="blacklisted" | eval comment=$c omment$ | eval [| rest /services/authentication/current-context | return username] | inputlookup append=t ip_blacklist_lookup.csv | dedup src_ip | table src_ip,status,username,comment | outputlookup ip_blacklist_lookup.csv

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rest
http://docs.splunk.com/Documentation/Splunk/4.3.2/RESTAPI/RESTaccess#authentication.2Fcurrent-contex...

[Ayn]

Does not matter as this REST endpoint only returns one single row, which is the context of the calling user.

From the docs:

authentication/current-context

Lists one item named "context" which contains the name of the current user

[responsys_cm]

But what if multiple users are logged in or what if somebody logs in after the user who is running the search from that dashboard?