Splunk Search

How to append rest command to my search?

Italy1358
Path Finder

I need help to append this rest command to my query. The problem is that the rest command is adding to the first row and I need it to be added to the row that was last entered.

| rest /services/authentication/current-context/context
| fields + username
| search username!=*splunk*
| append [
| inputlookup test.csv ]
| append
[| makeresults
| eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"]
| table username, user, description, user_added, revisit, category, department, description, manager
| outputlookup test.csv

example:
I go to my dashboard and enter user "tom" when I do the rest command should display my username since I entered the user "tom". Now I need to write this to the lookup table so that my name is next to "tom" entry row.

Labels (1)
Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

| inputlookup test.csv 
| append
[| makeresults | eval username=[| rest /services/authentication/current-context/context
| fields + username
| search username!=*splunk* | rename username as search | eval search="\"".search."\""]
| eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"]
| table username, user, description, user_added, revisit, category, department, description, manager
| outputlookup test.csv

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Give this a try

| inputlookup test.csv 
| append
[| makeresults | eval username=[| rest /services/authentication/current-context/context
| fields + username
| search username!=*splunk* | rename username as search | eval search="\"".search."\""]
| eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"]
| table username, user, description, user_added, revisit, category, department, description, manager
| outputlookup test.csv

Italy1358
Path Finder

Thank you, it worked!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...