I need help to append this rest command to my query. The problem is that the rest command is adding to the first row and I need it to be added to the row that was last entered. | rest /services/au...
See more...
I need help to append this rest command to my query. The problem is that the rest command is adding to the first row and I need it to be added to the row that was last entered. | rest /services/authentication/current-context/context | fields + username | search username!=*splunk* | append [ | inputlookup test.csv ] | append [| makeresults | eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"] | table username, user, description, user_added, revisit, category, department, description, manager | outputlookup test.csv example: I go to my dashboard and enter user "tom" when I do the rest command should display my username since I entered the user "tom". Now I need to write this to the lookup table so that my name is next to "tom" entry row.