Security

How to add the user who is performing a search as an event field

responsys_cm
Builder

We use some lookup tables to whitelist and blacklist events by src_ip. I've created a view that allows a user to input a src_ip and have that added to the lookup table. The search looks like:

index="logentry" | head 1 | eval src_ip=$src_ip$ | eval status="blacklisted" | eval comment=$c
omment$ | inputlookup append=t ip_blacklist_lookup.csv | dedup src_ip | table src_ip,status,commen
t | outputlookup ip_blacklist_lookup.csv

Is it possible to automatically append the user who executes the search as a field in the data? I'd rather that users not have to enter (or fail to enter) their username.

Can a view run a search on load like a dashboard can? I suppose I could search the _internal index on page load for the most recent event of that page loading and get the username there. Would that require giving the user access to the _internal index or could the view run that search as Splunk itself?

Thx.

Craig

Tags (1)

Ayn
Legend

You could grab the current username from the REST endpoint authentication/current-context using the rest command.

index="logentry" | head 1 | eval src_ip=$src_ip$ | eval status="blacklisted" | eval comment=$c omment$ | eval [| rest /services/authentication/current-context | return username] | inputlookup append=t ip_blacklist_lookup.csv | dedup src_ip | table src_ip,status,username,comment | outputlookup ip_blacklist_lookup.csv

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rest
http://docs.splunk.com/Documentation/Splunk/4.3.2/RESTAPI/RESTaccess#authentication.2Fcurrent-contex...

Ayn
Legend

Does not matter as this REST endpoint only returns one single row, which is the context of the calling user.

From the docs:

authentication/current-context

Lists one item named "context" which contains the name of the current user
0 Karma

responsys_cm
Builder

But what if multiple users are logged in or what if somebody logs in after the user who is running the search from that dashboard?

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...