You could do this:
index=myindex | eval [rest /services/search/jobs splunk_server=local | addinfo | where sid = info_sid | rename eai:acl.app as my_app_name | return my_app_name]
I just discovered that, starting with 6.5.0, there's some sweet new global tokens!
One of which is $env:app$
You could do this:
index=myindex | eval [rest /services/search/jobs splunk_server=local | addinfo | where sid = info_sid | rename eai:acl.app as my_app_name | return my_app_name]
Thanks! Just what I needed!
No luck with relative URLs?
I'm trying to build a dashboard that performs some operations on the URL en-US/app/app_name/ and I want this dashboard to work on all the apps without trying to change the app name.
I'm with @alacercogitatus though, curious what you're trying to achieve here.
Exactly what I was looking for.
Thanks
What are you trying to achieve here? Why would you want the app name in the search query?
What are you trying to achieve with that question? It's passive aggressive and unhelpful.