Security

How to setup auto search based on login name?

Cbr1sg
Path Finder

Hello all,
I want to setup Splunk in such a way that when an user logins to the dashboard, Splunk would be able to detect the name of user (preferably via LDAP search) and say "hello Mr. ABC, welcome to the dashboard blah blah" and it will also automatically search for the data related to that specific user and display the data without manual input from user himself.

Is it possible and how can it be done in Splunk? Thanks

Tags (1)
0 Karma
1 Solution

HiroshiSatoh
Champion

Is this information?

|rest /services/authentication/current-context/context

View solution in original post

paramagurukarth
Builder

There are some such useful details are readily available in splunk token.
You can use that in your html and search...
Check this

Cbr1sg
Path Finder

very useful info, thank you!

0 Karma

paramagurukarth
Builder

Always welcome

0 Karma

splunker12er
Motivator

Search query:

| rest /services/authentication/current-context | where username!="splunk-system-user" | fields username| replace * with "Welcome \"*\" !" in username

Create a dashboard panel
Set the Visualization to "single value"
as like u may customize your search query and pass the username to load user related results

alt text

Cbr1sg
Path Finder

unfortunately i can't accept another answer, but this also solves my problem. Thank you!

0 Karma

paramagurukarth
Builder

But you can accept the best answer

0 Karma

HiroshiSatoh
Champion

Is this information?

|rest /services/authentication/current-context/context

Cbr1sg
Path Finder

Exactly what I'm looking for. thank you very much

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...