https://community.splunk.com/t5/Security/Help-in-identifying-the-capabilities-for-REST-search-to-fetch/m-p/451888#M10566 <P>Hi all,<BR /> I have the below rest searches to fetch the User, Role and Application details, respectively.</P> <UL> <LI>| rest /services/authentication/users</LI> <LI>| rest /services/authorization/roles</LI> <LI>| rest /services/apps/local</LI> </UL> <P>However, am not able to define the exact read only capabilities for my role to assign, so I can run these searches to get the results.</P> <P>Below are the capabilities I investigated:<BR /> edit_roles<BR /> edit_user<BR /> rest_properties_get<BR /> search</P> <P>However, am not getting the entire application list as compared to Admin role. Also the edit_roles and edit_user are giving write permission and am looking for read permission only.</P> <P>Please help.</P> Wed, 30 Sep 2020 00:28:33 GMT harshal_chakran 2020-09-30T00:28:33Z https://community.splunk.com/t5/Security/Help-in-identifying-the-capabilities-for-REST-search-to-fetch/m-p/451888#M10566 <P>Hi all,<BR /> I have the below rest searches to fetch the User, Role and Application details, respectively.</P> <UL> <LI>| rest /services/authentication/users</LI> <LI>| rest /services/authorization/roles</LI> <LI>| rest /services/apps/local</LI> </UL> <P>However, am not able to define the exact read only capabilities for my role to assign, so I can run these searches to get the results.</P> <P>Below are the capabilities I investigated:<BR /> edit_roles<BR /> edit_user<BR /> rest_properties_get<BR /> search</P> <P>However, am not getting the entire application list as compared to Admin role. Also the edit_roles and edit_user are giving write permission and am looking for read permission only.</P> <P>Please help.</P> Wed, 30 Sep 2020 00:28:33 GMT https://community.splunk.com/t5/Security/Help-in-identifying-the-capabilities-for-REST-search-to-fetch/m-p/451888#M10566 harshal_chakran 2020-09-30T00:28:33Z https://community.splunk.com/t5/Security/Help-in-identifying-the-capabilities-for-REST-search-to-fetch/m-p/451889#M10567 <P>Can you elaborate a little here?<BR /> what is the problem you are trying to solve?<BR /> What is the outcome / search output you are anticipating?</P> Tue, 14 May 2019 00:37:30 GMT https://community.splunk.com/t5/Security/Help-in-identifying-the-capabilities-for-REST-search-to-fetch/m-p/451889#M10567 adonio 2019-05-14T00:37:30Z https://community.splunk.com/t5/Security/Help-in-identifying-the-capabilities-for-REST-search-to-fetch/m-p/451890#M10568 <P>Please check if the answer <A href="https://answers.splunk.com/answers/745460/rest-call-in-subsearch.html">https://answers.splunk.com/answers/745460/rest-call-in-subsearch.html</A> helps you<BR /> The original query is for indexes, but you can put the other REST endpoints change to see if it works.</P> Tue, 14 May 2019 09:57:04 GMT https://community.splunk.com/t5/Security/Help-in-identifying-the-capabilities-for-REST-search-to-fetch/m-p/451890#M10568 koshyk 2019-05-14T09:57:04Z https://community.splunk.com/t5/Security/Help-in-identifying-the-capabilities-for-REST-search-to-fetch/m-p/451891#M10569 <P>I have a certain dashboard listing all Splunk users and what role-capabilities are assigned to them. For which I have used the above mentioned Rest API commands.</P> <P>However the dashboard users are not able to see the results as they don't below capabilities.</P> <PRE><CODE>edit_roles edit_user rest_properties_get search </CODE></PRE> <P>If I assign these capabilities to them, then they can delete/update the user-role information from GUI settings, which I don't want.</P> Tue, 14 May 2019 15:14:24 GMT https://community.splunk.com/t5/Security/Help-in-identifying-the-capabilities-for-REST-search-to-fetch/m-p/451891#M10569 harshal_chakran 2019-05-14T15:14:24Z