I found this search and it works well for the information I need. However, I have been unable to create a drop-down of the user ID so that I can display only one users information at a time:
|rest /services/authentication/users splunk_server=local
|fields title realname roles |rename title as userName|rename realname as Name
My Dropdown search is: user=* | fields user | dedup user
My Token is: myuser
What I'm having a problem with is getting the myuser in the right place in the first search, or do I need to create an additional line in the main search that I populate with the $myuser$?
|rest /services/authentication/users splunk_server=local user=$myuser$
|fields title realname roles |rename title as userName|rename realname as Name
Just add it to the filter part of your original search.