Splunk Search

whoami doesn't support external lookup?

soe_hlawin
Explorer

I have installed the app whoami. when I use it as a command from splunkweb search, it works as expected.

But when I want to use this command inside a python script which is invoked from splunkweb search (as an automated external lookup), this returns no search_user field. Moreover, if there is any CLI session on the linux server, the whoami command is returning that user than that of the splunkweb user.

Please suggest if there is any way to let whoami know to exclusively retun only the splunkweb user.

0 Karma
1 Solution

bwooden
Splunk Employee
Splunk Employee

The whoami app was written before the release of Splunk 4.3 for use in creating reports specific to current logged in user. When that version of Splunk introduced the rest command it obviated the need for the whoami app and I quit maintaining it.

Please use the rest command in place of the whoami custom search command going forward.

One way to use it would be to add the results to each event (one of the modes supported by whoami) using a join:

* | head 10 | join [ | rest splunk_server=local /services/authentication/current-context | rename username as auth_user_id | fields auth_user_id ] 

View solution in original post

0 Karma

bwooden
Splunk Employee
Splunk Employee

The whoami app was written before the release of Splunk 4.3 for use in creating reports specific to current logged in user. When that version of Splunk introduced the rest command it obviated the need for the whoami app and I quit maintaining it.

Please use the rest command in place of the whoami custom search command going forward.

One way to use it would be to add the results to each event (one of the modes supported by whoami) using a join:

* | head 10 | join [ | rest splunk_server=local /services/authentication/current-context | rename username as auth_user_id | fields auth_user_id ] 
0 Karma

bwooden
Splunk Employee
Splunk Employee

App removed.

bwooden
Splunk Employee
Splunk Employee

Good point and/or request. I've just sent a note to splunkbase admin requesting app removal.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

could add a note to the top of the description or docs for this app, or remove the app entirely then?

bwooden
Splunk Employee
Splunk Employee

This was just added to the rest command's example section: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rest#Examples

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...