Splunk Search

How to append rest command to my search?

Italy1358
Path Finder

I need help to append this rest command to my query. The problem is that the rest command is adding to the first row and I need it to be added to the row that was last entered.

| rest /services/authentication/current-context/context
| fields + username
| search username!=*splunk*
| append [
| inputlookup test.csv ]
| append
[| makeresults
| eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"]
| table username, user, description, user_added, revisit, category, department, description, manager
| outputlookup test.csv

example:
I go to my dashboard and enter user "tom" when I do the rest command should display my username since I entered the user "tom". Now I need to write this to the lookup table so that my name is next to "tom" entry row.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

| inputlookup test.csv 
| append
[| makeresults | eval username=[| rest /services/authentication/current-context/context
| fields + username
| search username!=*splunk* | rename username as search | eval search="\"".search."\""]
| eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"]
| table username, user, description, user_added, revisit, category, department, description, manager
| outputlookup test.csv

View solution in original post

somesoni2
Revered Legend

Give this a try

| inputlookup test.csv 
| append
[| makeresults | eval username=[| rest /services/authentication/current-context/context
| fields + username
| search username!=*splunk* | rename username as search | eval search="\"".search."\""]
| eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"]
| table username, user, description, user_added, revisit, category, department, description, manager
| outputlookup test.csv

Italy1358
Path Finder

Thank you, it worked!!

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...