This app worked great. I havent been able to send the value from whoami to a variable and need to keep repeating the code but the app worked well.
index="hrxref_data" sourcetype="HR_XREF" ([| whoami fieldname=MOID | fields MOID] OR [| whoami fieldname=LVL1_MOID | fields LVL1_MOID]) | eval sk=if([| whoami fieldname=MOID | fields MOID], "1", "2") | table sk, EMP_NAME, JOB_DESC, LOC_DESC, MOID, NT_USER_ID, SignonID | sort sk
it seems like I should be able to send the WHOAMI value to a variable and just use that.. Any insight would be great.
... View more