Splunk Search

How to append rest command to my search?

Italy1358
Path Finder

I need help to append this rest command to my query. The problem is that the rest command is adding to the first row and I need it to be added to the row that was last entered.

| rest /services/authentication/current-context/context
| fields + username
| search username!=*splunk*
| append [
| inputlookup test.csv ]
| append
[| makeresults
| eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"]
| table username, user, description, user_added, revisit, category, department, description, manager
| outputlookup test.csv

example:
I go to my dashboard and enter user "tom" when I do the rest command should display my username since I entered the user "tom". Now I need to write this to the lookup table so that my name is next to "tom" entry row.

Labels (1)
Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

| inputlookup test.csv 
| append
[| makeresults | eval username=[| rest /services/authentication/current-context/context
| fields + username
| search username!=*splunk* | rename username as search | eval search="\"".search."\""]
| eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"]
| table username, user, description, user_added, revisit, category, department, description, manager
| outputlookup test.csv

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Give this a try

| inputlookup test.csv 
| append
[| makeresults | eval username=[| rest /services/authentication/current-context/context
| fields + username
| search username!=*splunk* | rename username as search | eval search="\"".search."\""]
| eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"]
| table username, user, description, user_added, revisit, category, department, description, manager
| outputlookup test.csv

Italy1358
Path Finder

Thank you, it worked!!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...