topic Re: Splunk rest API (list all users) in Splunk Dev

Splunk rest API (list all users)

splunk_luis12 — Thu, 15 Sep 2022 19:42:15 GMT

Hi folks,

I'm tying to list all users from my Splunk cloud using this link:

https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTREF/RESTaccess#authentication.2Fusers:~:text=s%3Adict%3E%0A%20%20%20%3C/content%3E%0A%20%3C/entry%3E-,authentication/users,-https%3A//%3Chost%3E%3A%3CmPort

However I'm using a custom role who just have the following capabilities:

* admin_all_objects
* rest_access_server_endpoints
* rest_apps_management
* rest_apps_view
* rest_properties_get
*edit_user
*search

The user is unable to pull all users. My assumption is that as this users does not inheritance any other role then it is not able to list all users, as per the grantableRoles.

If I'm right, what chance do I have for this user to pull all users with the rest API? or what capabilities I'm missing?

Thanks in advance,

Re: Splunk rest API (list all users)

richgalloway — Thu, 15 Sep 2022 19:54:17 GMT

The admin_all_objects capability should be all you need.

Have you tried using servicesNS?

| rest /servicesNS/-/-/admin/users

Re: Splunk rest API (list all users)

splunk_luis12 — Thu, 15 Sep 2022 20:02:19 GMT

Hi @richgalloway I already tried with | rest /servicesNS/-/-/admin/users as well but I got the same result even using the admin_all_objects capability.