Splunk Search

How to append rest command to my search?

Italy1358
Path Finder

I need help to append this rest command to my query. The problem is that the rest command is adding to the first row and I need it to be added to the row that was last entered.

| rest /services/authentication/current-context/context
| fields + username
| search username!=*splunk*
| append [
| inputlookup test.csv ]
| append
[| makeresults
| eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"]
| table username, user, description, user_added, revisit, category, department, description, manager
| outputlookup test.csv

example:
I go to my dashboard and enter user "tom" when I do the rest command should display my username since I entered the user "tom". Now I need to write this to the lookup table so that my name is next to "tom" entry row.

Labels (1)
Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

| inputlookup test.csv 
| append
[| makeresults | eval username=[| rest /services/authentication/current-context/context
| fields + username
| search username!=*splunk* | rename username as search | eval search="\"".search."\""]
| eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"]
| table username, user, description, user_added, revisit, category, department, description, manager
| outputlookup test.csv

View solution in original post

somesoni2
Revered Legend

Give this a try

| inputlookup test.csv 
| append
[| makeresults | eval username=[| rest /services/authentication/current-context/context
| fields + username
| search username!=*splunk* | rename username as search | eval search="\"".search."\""]
| eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"]
| table username, user, description, user_added, revisit, category, department, description, manager
| outputlookup test.csv

Italy1358
Path Finder

Thank you, it worked!!

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...