The user function returns the login username of the user who created the current search.

To get the user’s friendly display name (typically first and last name) instead, use displayUsername().

Syntax ​

user()

Arguments ​

None.

Returns ​

A string containing the login username of the user who created the search.

Examples ​

Filter events to those belonging to the current user:

dataset=myDataset
|| where owner == user()

Tag exported results with the name of the user who ran the search:

dataset=myDataset
|| extend run_by=user(), search_id=jobID()
|| export to lake myAuditDataset