Dear ALL,
I want to insert a value into a subsearch using the search result as a variable.
Do the following search to get your own username
Is there a way to search again with my username?
=========================================
| rest / services / authentication / current-context
| table realname
=========================================
rlaname
------------------------------------------
M_sugiyama ← Use this value as a variable
=========================================
index=AD "M_sugiyama" ← I want to search by assigning variables to the next subsearch
=========================================
Do you have a good idea?
Recall that subsearches execute before the main search so the query to get the username must be the subsearch and that result is "passed" to the main search.
index=AD [| rest / services / authentication / current-context
| table realname]
If the value exists in a field in the second search, you can do something like this
index=AD
| search [| rest /services/authentication/current-context
| table realname
| rename realname as rlaname]
If that doesn't work, there are other things you could try