Quantcast
Viewing all articles
Browse latest Browse all 47296

Splunk DB Connect 2: How to pass a Splunk username in my dbxquery?

I am trying to run a query with variables using the `dbxquery` command. I want to pass Splunk username in my query. I have tried following, but was not successful: |rest /services/authentication/current-context | search username!="splunk-system-user" | table username | eval user=username | eval searchquery="\"SELECT * FROM PERSONS WHERE USERNAME='".user."'\"" |search [|dbxquery connection=dev_all_privs query=searchquery shortnames=true| fields - _*| return ID, FIRST_NAME]| fields *

Viewing all articles
Browse latest Browse all 47296

Trending Articles