I am trying to create a central dashboard for my team. I would like this dashboard to load cases that are owned by the individual logged in and accessing that dashboard by dynamically populating their user account in the "Owner=" field condition. I have identified a variable called $CurrentUser and have proven that ArcSight will identify that variable as the person logged in and will replace the variable with their user name when presenting data.
For example, lets say the user looking at a query has a username of "JSMITH" if they create a query where they specify a condition like:
Owner = $CurrentUser
the case condition will automatically populate with:
Owner = ("/all Users/Custom User Groups/Users/JSMITH")
Which is great, except that I am only able to get it to work the first time I save the query. Every time someone else loads that query via a query viewer the variable is gone and it is my user name that remains, which then presents them with my data where I am the owner
I then identified that I could get the variable "$CurrentUser" to remain as the condition if I entered it as a parameter with the advanced editor, by checking the parameter box and entering the $CurrentUser variable as the default value. The condition then remains but in the following state:
Owner = @=$CurrentUser
However, when this is loaded it no longer updates the condition with the logged in user's user name.
In short, I am attempting to create a query viewer that will identify who is logged in and looking at that query viewer table, then populate the Owner= condition with the user name of the person that is logged in. The purpose is to maintain a centrally managed dashboard for the entire team without having to have everyone update their dashboards every time a change is made, or recreate them when a new user starts.
Any help would be appreciated.