We use some lookup tables to whitelist and blacklist events by src_ip. I've created a view that allows a user to input a src_ip and have that added to the lookup table. The search looks like:
index="logentry" | head 1 | eval src_ip=$src_ip$ | eval status="blacklisted" | eval comment=$c
omment$ | inputlookup append=t ip_blacklist_lookup.csv | dedup src_ip | table src_ip,status,commen
t | outputlookup ip_blacklist_lookup.csv
Is it possible to automatically append the user who executes the search as a field in the data? I'd rather that users not have to enter (or fail to enter) their username.
Can a view run a search on load like a dashboard can? I suppose I could search the _internal index on page load for the most recent event of that page loading and get the username there. Would that require giving the user access to the _internal index or could the view run that search as Splunk itself?
Thx.
Craig
You could grab the current username from the REST endpoint authentication/current-context
using the rest
command.
index="logentry" | head 1 | eval src_ip=$src_ip$ | eval status="blacklisted" | eval comment=$c omment$ | eval [| rest /services/authentication/current-context | return username] | inputlookup append=t ip_blacklist_lookup.csv | dedup src_ip | table src_ip,status,username,comment | outputlookup ip_blacklist_lookup.csv
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rest
http://docs.splunk.com/Documentation/Splunk/4.3.2/RESTAPI/RESTaccess#authentication.2Fcurrent-contex...
Does not matter as this REST endpoint only returns one single row, which is the context of the calling user.
From the docs:
authentication/current-context
Lists one item named "context" which contains the name of the current user
But what if multiple users are logged in or what if somebody logs in after the user who is running the search from that dashboard?