Get the roles from rest API and set to field in search

[bhupalbobbadi]

I need to get the roles assigned to current logged in user and set the value to filed in search. Anybody has any idea. I tried the following and got the error.

|makeresults|eval rls=[|rest /services/authentication/current-context |eval rls="\"".roles."\""|eval user="\"".username."\""|eval rlss=mvjoin(roles,",")|return $rlss]

but got the error : Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression
not much details in logs.

Anybody has any idea how to fix this?

TIA.

[nareshinsvu · Accepted solution]

Why can't rlss be your new field? No need to makeresult and append your results to another filed again. Are you not missing few roles with your sub-query? Can you try this?

|rest /services/authentication/current-context|mvexpand roles | eval rlss="\""+roles+","+username+"\"" | fields rlss

[bhupalbobbadi]

Thanks Naresh, Your query producing results, but my requirement is get and assign all roles (comma separated string value) for the current user and set it to a field in main query.

[nareshinsvu]

Will this help? This will append rlss as a new column to your outside query

|makeresults|appendcols [|rest /services/authentication/current-context|mvexpand roles |  eval rlss="\""+roles+","+username+"\"" | fields rlss]

[nareshinsvu]

Alternatively if you want to do some comparisions with the subsearch, best way is to route the results to a lookup and then compare. Small example below

|makeresults [|rest /services/authentication/current-context|mvexpand roles |  eval rlss=+roles+","+username | fields rlss username | dedup  rlss| outputlookup rlss.csv] | eval mainuser="splunk-system-user" | lookup rlss.csv username as  mainuser