Splunk Search

retreiving current logged in user and using in search

googs524
Explorer

I tried below command to retrieve current logged in user

| rest /services/authentication/current-context | table username

But unable to use output of this as an input to another search to find something else. Any idea how I can get output of above command as input to another?

Tags (1)
0 Karma

adonio
Ultra Champion
0 Karma

googs524
Explorer

Thanks for your response. These are good points, but not specific to my requirement.

0 Karma

HiroshiSatoh
Champion

How do you want to use it?

index=* [| rest /services/authentication/current-context | table username]

| rest /services/authentication/current-context | table username|map search="search index=* username=$username$"

googs524
Explorer

Thanks for the inputs. I tried below command and was able to get desired output upon modifying it. But the issue, I am facing is, if I convert that output of command as Single value visualization and create as a dashboard, it gives me nothing. It says " Search is waiting for input". Any idea how to resolve this?

| rest /services/authentication/current-context | table username|map search="search index=* username=$username$"

0 Karma

HiroshiSatoh
Champion

Please tell me the search sentence.

0 Karma