Splunk Search

Wanted to convert a search to a drop down listing, but not certain where to place the token.

nls7010
Path Finder

I found this search and it works well for the information I need. However, I have been unable to create a drop-down of the user ID so that I can display only one users information at a time:

|rest /services/authentication/users splunk_server=local
|fields title realname roles |rename title as userName|rename realname as Name

My Dropdown search is: user=* | fields user | dedup user
My Token is: myuser

What I'm having a problem with is getting the myuser in the right place in the first search, or do I need to create an additional line in the main search that I populate with the $myuser$?

Tags (1)
0 Karma

kmaron
Motivator
|rest /services/authentication/users splunk_server=local user=$myuser$
|fields title realname roles |rename title as userName|rename realname as Name

Just add it to the filter part of your original search.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...