topic Re: How can I display the current users metric index and their access permissions? in Security

How can I display the current users metric index and their access permissions?

DATEVeG — Tue, 05 Jun 2018 12:19:54 GMT

Hi,

We created a new app, which is configured as the default app for most of the users.
The app contains a default view, which lists all splunk indexes including the metric indexes.

For each index, there is a column which indicates, if the current user has access permissions for the corresponding index.
Our method to list all indexes with access permissions for the current user is:
| eventcount summarize=false index=*

However, this method doesn't work for the new indextype metric.

How can I list all the indexes, which the currently logged in user has access to?
The list should include the indexes searched by default and also the indexes which must be specified explicitly.

Thanks!
- Lorenz

Re: How can I display the current users metric index and their access permissions?

felipesewaybric — Wed, 20 Jun 2018 04:18:49 GMT

I don't get it, with the above, all you do is counting every index that 'summarize' is false?

What I would do is something like:

index=* | dedup index | table index

Can you give other example or something?

What is the name of that column?

Re: How can I display the current users metric index and their access permissions?

DATEVeG — Wed, 20 Jun 2018 05:47:13 GMT

In the world of event indexes, your example with
index=* | dedup index | table index
will work. It is just ways slower than my solution above.

With the new metric indexes in Splunk 7.x, i don't know how to archive the same result.
So again my question:
How can I list all metric indexes, which the currently logged in user has access to?

Re: How can I display the current users metric index and their access permissions?

slippenh — Wed, 20 Jun 2018 13:52:41 GMT

Try this "| eventcount summarize=false index=* | dedup index | fields index"

Re: How can I display the current users metric index and their access permissions?

DATEVeG — Wed, 20 Jun 2018 13:58:28 GMT

This doesn't show any metric indexes.

Re: How can I display the current users metric index and their access permissions?

poete — Tue, 29 Sep 2020 20:02:36 GMT

Hello,

In case of metrics this does what you want:
| mstats count(_value) where index=someMetricsIndex AND metric_name=*

Re: How can I display the current users metric index and their access permissions?

DATEVeG — Thu, 21 Jun 2018 06:12:09 GMT

Hi,

your SPL-Statement will show all the metrics in one index.

What i want:
- List all metric indexes which exists
- List all metric indexes which the currently logged in user has access to

Re: How can I display the current users metric index and their access permissions?

poete — Tue, 29 Sep 2020 20:06:59 GMT

OK. And what about this?

| mstats count(_value) where index=* AND metric_name=* by index

Re: How can I display the current users metric index and their access permissions?

DATEVeG — Thu, 21 Jun 2018 11:54:27 GMT

This is working as expected.
Thanks!