whoami doesn't support external lookup?

[soe_hlawin]

I have installed the app whoami. when I use it as a command from splunkweb search, it works as expected.

But when I want to use this command inside a python script which is invoked from splunkweb search (as an automated external lookup), this returns no search_user field. Moreover, if there is any CLI session on the linux server, the whoami command is returning that user than that of the splunkweb user.

Please suggest if there is any way to let whoami know to exclusively retun only the splunkweb user.

[bwooden · Accepted solution]

The whoami app was written before the release of Splunk 4.3 for use in creating reports specific to current logged in user. When that version of Splunk introduced the rest command it obviated the need for the whoami app and I quit maintaining it.

Please use the rest command in place of the whoami custom search command going forward.

One way to use it would be to add the results to each event (one of the modes supported by whoami) using a join:

* | head 10 | join [ | rest splunk_server=local /services/authentication/current-context | rename username as auth_user_id | fields auth_user_id ] 

[bwooden]

App removed.

[bwooden]

Good point and/or request. I've just sent a note to splunkbase admin requesting app removal.

[gkanapathy]

could add a note to the top of the description or docs for this app, or remove the app entirely then?

[bwooden]

This was just added to the rest command's example section: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rest#Examples