Splunk Search

Get current user from Custom Search Command

maxdouglas
Engager

Hello Splunkers,

I am developing an app containing a Custom Generating Search Command. (I think the Generating part is irrelevant for this case)
I need my custom command to get the user who executed this search.

Following the page below, I got to this code, which returns the wrong user:
http://dev.splunk.com/view/python-sdk/SP-CAAAEJ6#currentuser

from splunklib.searchcommands import GeneratingCommand, dispatch, Configuration
from splunklib import client

@Configuration(streaming=True, local=True)
class MyCommand(GeneratingCommand):
    def generate(self):
        service = client.connect(username='fixed_user', password='fixed_password')
        user = service.username  # user is fixed_user, not the current user
        yield {'_time': time.time(),'_raw': user}

dispatch(MyCommand, sys.argv, sys.stdin, sys.stdout, __name__)

When I execute the search | mycommand on Splunk Web, I get fixed_user, not the current logged user.
How can my custom command know which user is calling it?

0 Karma
1 Solution

anatoliikostin
Explorer

You can make use of self which is passed into generate(self):

user = self._metadata.searchinfo.username

View solution in original post

anatoliikostin
Explorer

You can make use of self which is passed into generate(self):

user = self._metadata.searchinfo.username

Get Updates on the Splunk Community!

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...

Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

  Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...