I want to insert a value into a subsearch using the search result as a variable.

[Msugiyama]

Dear ALL,

I want to insert a value into a subsearch using the search result as a variable.

Do the following search to get your own username
Is there a way to search again with my username?

=========================================

| rest / services / authentication / current-context
| table realname

=========================================

rlaname
------------------------------------------
M_sugiyama                               ← Use this value as a variable

=========================================

index=AD "M_sugiyama"      ← I want to search by assigning variables to the next subsearch

=========================================

Do you have a good idea?

[richgalloway]

Recall that subsearches execute before the main search so the query to get the username must be the subsearch and that result is "passed" to the main search.

index=AD [| rest / services / authentication / current-context
| table realname]

[ITWhisperer]

If the value exists in a field in the second search, you can do something like this

index=AD 
| search [| rest /services/authentication/current-context
| table realname
| rename realname as rlaname]

If that doesn't work, there are other things you could try