How to use Splunk REST API to create/update a role with more than 1 index access?

premrajvs — Tue, 19 Sep 2023 19:40:16 GMT

I am trying to create roles via API and here is the curl request. Question I have is, I am not able to add more than 1 index to the srchIndexesAllowed field either when I create the role or when I update the role. I am not able to find any Splunk documentation around the request body.

Does anyone know how I can add/update multiple indexes for a role.

curl --location 'https://XXXXXXXXXXXXXXX/services/authorization/roles/fi_a00002-namespace_nonprod_power' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --header 'Authorization: Basic XXXXXXXXXXXXXXXX' \ --data-urlencode 'imported_roles=user' \ --data-urlencode 'srchIndexesAllowed=index1,index2' \ --data-urlencode 'srchIndexesDefault=index1,index2'

Re: How to use Splunk REST API to create/update a role with more than 1 index access?

jalecrim_decat — Tue, 06 Aug 2024 16:40:21 GMT

Trying the same here, getting an error while having the proper permissions:
{"messages":[{"type":"ERROR","text":"Current user doesn't have permission to add index test"}]}

topic How to use Splunk REST API to create/update a role with more than 1 index access? in Splunk Cloud Platform

How to use Splunk REST API to create/update a role with more than 1 index access?

Re: How to use Splunk REST API to create/update a role with more than 1 index access?