When I run the below query as an admin it returns results however when run as a user it does not. The user is a power user with admin rights, the time picker is set the same. There are no exclusions from the users rights to indexes ( as far as I can tell) index="login_data" sourcetype="Login_Data"[search index="hrxref_data" sourcetype="HR_XREF" earliest=-60d (LVL1_MOID="xx" OR MOID="xx") | table SignonID ] | eval SignonID=upper(SignonID) | bucket _time span=1d | stats count as LoginCount by _time, SignonID | join type=outer SignonID [search index="hrxref_data" sourcetype="HR_XREF" earliest=-60d (LVL1_MOID="xx" OR MOID="xx") | table SignonID EMP_NAME ] | timechart values(LoginCount) as LoginCount by EMP_NAME ... View more

I am looking for the simplest way to pass the login name to a variable in a query. I want the $formMgrVZID$ to be the id that was used to login to splunk. This query has the variables (SformMgrVZID$) Index=”hrxref_data” sourcetype="HR_XREF" earliest=-45d (VZID="$formMgrVZID$" OR LVL1_VZID="$formMgrVZID$") | eval sk=if(VZID="$formMgrVZID$", "1", "2") | table sk, EMP_NAME, JOB_DESC, VZID, NT_USER_ID, SignonID | sort sk ... View more