- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need help to append this rest command to my query. The problem is that the rest command is adding to the first row and I need it to be added to the row that was last entered.
| rest /services/authentication/current-context/context
| fields + username
| search username!=*splunk*
| append [
| inputlookup test.csv ]
| append
[| makeresults
| eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"]
| table username, user, description, user_added, revisit, category, department, description, manager
| outputlookup test.csv
example:
I go to my dashboard and enter user "tom" when I do the rest command should display my username since I entered the user "tom". Now I need to write this to the lookup table so that my name is next to "tom" entry row.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Give this a try
| inputlookup test.csv
| append
[| makeresults | eval username=[| rest /services/authentication/current-context/context
| fields + username
| search username!=*splunk* | rename username as search | eval search="\"".search."\""]
| eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"]
| table username, user, description, user_added, revisit, category, department, description, manager
| outputlookup test.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Give this a try
| inputlookup test.csv
| append
[| makeresults | eval username=[| rest /services/authentication/current-context/context
| fields + username
| search username!=*splunk* | rename username as search | eval search="\"".search."\""]
| eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"]
| table username, user, description, user_added, revisit, category, department, description, manager
| outputlookup test.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, it worked!!
