I am trying to run a query with variables using the `dbxquery` command. I want to pass Splunk username in my query. I have tried following, but was not successful:
|rest /services/authentication/current-context | search username!="splunk-system-user" | table username
| eval user=username
| eval searchquery="\"SELECT * FROM PERSONS WHERE USERNAME='".user."'\""
|search [|dbxquery connection=dev_all_privs query=searchquery shortnames=true| fields - _*| return ID, FIRST_NAME]| fields *
↧