How do I determine the username of the currently logged in user from a python script? Elsewhere we are using scripted auth and that python script has several methods that Splunk calls and passes in the username; each method makes a HTTP POST to a REST API running on one of our servers. We need to use a similar approach to what we do in scripted auth's getUserInfo method, but have it be invoked from a custom command (defined in commands.conf), which means that the username won't be passed in. I assume that there is some way to get the current username, just haven't been able to find it yet. Thanks for any pointers,
You can extract it from the auth token.
First, in the definition of your search command in
[yourcommand] filename = yourcommand.py passauth = true
Your script will then receive a token that looks like:
<auth> <userId>admin</userId> <username>admin</username> <authToken>cbd900f3b28014a1e233679d05dcd805</authToken> </auth>
(Note: The auth token will actually be in a single line with no whitespace. The above formatting is only for readability.)
Once you have that, it's just a matter of extracting the username from the string. For example, if you're using InterSplunk:
import splunk.Intersplunk as si results, dummyresults, settings = si.getOrganizedResults() authString = settings.get("authString", None) if authString != None: start = authString.find('<userId>') + 8 stop = authString.find('</userId>') user = authString[start:stop]
It looks like
settings["owner"] will directly gives the user ID.
results, dummyresults, settings = splunk.Intersplunk.getOrganizedResults()