Splunk Search

search based on logged in user id

Sriram
Communicator

I need to plug in the logged in user id and build a search query. How do I accomplish this ? I see
cherrypy.session['user']['name'] command provides something similar to this. How do I incorporate this command (or something similar) in my search query.

Thanks
Sriram

1 Solution

bwooden
Splunk Employee
Splunk Employee

There is a sneaky way this can be accomplished out of box using macros. I can explain that further if needed. I've also just uploaded an app called 'whoami'. Let me know how it works for you or if you have any feature requests or improvement ideas.

View solution in original post

Jason
Motivator

You can also (in 4.3+) get this information from the rest command:

something like this will add a new username field to your events:

| join [rest /services/authentication/current-context splunk_server=local| fields + username]
0 Karma

bwooden
Splunk Employee
Splunk Employee

There is a sneaky way this can be accomplished out of box using macros. I can explain that further if needed. I've also just uploaded an app called 'whoami'. Let me know how it works for you or if you have any feature requests or improvement ideas.

Sriram
Communicator

I sporadically get this error for some user ids. Any ideas why I am getting these. I am not sure whether it is id related or something else.
[subsearch]: External search command 'whoami'returned error code 1.
Here is the query.
index=cc_user_summary source=list_users [| whoami fieldname=userUid | fields userUid ] | dedup displayName

0 Karma

Sriram
Communicator

This worked like a charm. Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...