Security

Pass login id to query

james_j_taylor
Explorer

I am looking for the simplest way to pass the login name to a variable in a query. I want the $formMgrVZID$ to be the id that was used to login to splunk.

This query has the variables (SformMgrVZID$)

Index=”hrxref_data” sourcetype="HR_XREF" earliest=-45d (VZID="$formMgrVZID$" OR LVL1_VZID="$formMgrVZID$") | eval sk=if(VZID="$formMgrVZID$", "1", "2") | table sk, EMP_NAME, JOB_DESC, VZID, NT_USER_ID, SignonID | sort sk

Tags (2)
0 Karma

james_j_taylor
Explorer

This app worked great. I havent been able to send the value from whoami to a variable and need to keep repeating the code but the app worked well.

index="hrxref_data" sourcetype="HR_XREF" ([| whoami fieldname=MOID | fields MOID] OR [| whoami fieldname=LVL1_MOID | fields LVL1_MOID]) | eval sk=if([| whoami fieldname=MOID | fields MOID], "1", "2") | table sk, EMP_NAME, JOB_DESC, LOC_DESC, MOID, NT_USER_ID, SignonID | sort sk

it seems like I should be able to send the WHOAMI value to a variable and just use that.. Any insight would be great.

0 Karma

james_j_taylor
Explorer

The App worked great if I enter it in the standard search but I am struggling to integrate it into my search string. The documentation is a little light.

sourcetype="HR_XREF" earliest=-45d (VZID=[|whoami fieldname=user|fields user] OR LVL1_VZID=[|whoami fieldname=user|fields user])| eval sk=if(VZID=[|whoami fieldname=user|fields user], "1", "2")

| table sk, EMP_NAME, JOB_DESC, VZID, NT_USER_ID, SignonID | sort sk

0 Karma

sowings
Splunk Employee
Splunk Employee

You might want to check out the whoami app:

http://apps.splunk.com/app/915

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.