Splunk Search

I want to insert a value into a subsearch using the search result as a variable.

Msugiyama
Explorer

Dear ALL,

I want to insert a value into a subsearch using the search result as a variable.

Do the following search to get your own username
Is there a way to search again with my username?

=========================================

| rest / services / authentication / current-context
| table realname

=========================================

rlaname
------------------------------------------
M_sugiyama                               ← Use this value as a variable

=========================================

index=AD "M_sugiyama"      ← I want to search by assigning variables to the next subsearch

=========================================

Do you have a good idea?

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Recall that subsearches execute before the main search so the query to get the username must be the subsearch and that result is "passed" to the main search.

index=AD [| rest / services / authentication / current-context
| table realname]
---
If this reply helps you, an upvote would be appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

If the value exists in a field in the second search, you can do something like this

index=AD 
| search [| rest /services/authentication/current-context
| table realname
| rename realname as rlaname]

If that doesn't work, there are other things you could try

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!