Security

Splunk MINT: How to set a user identification string (userIdentifier) after initializing Splunk?

timgcarlson
New Member

I'm initializing and starting MINT in the app delegate. I want to use a user identification string that they will enter on the first launch of the app. I will not have this string until after they enter it in. It is saved to the database, so on future app launches I can get this product key in the app delegate, but not the first time the app delegate launches (on the first ever app launch).

My question is, if the userIdentifier has to be set before the init, how should I go about initializing Splunk on this first app launch, and setting the userIdentifier after the fact? Can I simply reinitialize Splunk once I have the userIdentifier?

Tags (5)
0 Karma

croyal_splunk
Splunk Employee
Splunk Employee

For the issue "can't set the userIdentifier after initialization. Don't have the data until after the first run." We'd recommend using some sort of default value, like 'first_time_run' to set the userIdentifier when you don't know it. On subsequent runs, you can place the correct value.  This way, you can capture all the data for the first time run and set the correct value on subsequent runs.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...