is there a possibility to use the |rest command with an eval like:
|eval test = [rest /services/authentication/current-context
|rename username as user|return $user]
With this search I just get an empty field test. But why?
Use it like this (run anywhere code). You're extracting string and its need to be within double quotes for eval to work.
|stats count |eval test = [|rest /services/authentication/current-context |eval user="\"".username."\""|return $user]
View solution in original post
Thank you very much. That solved the problem.
Another possibility is to use:
"+" instead of "." in the eval