topic Re: How to generate users list without admin access? in Splunk Dev

How to generate users list without admin access?

rendie — Wed, 08 Jul 2020 12:09:37 GMT

Hi everyone,

I need to generate a list with all users in Splunk Enterprise, but I stuck on permissions.

I have simple a user (without admin access) and when I tried to make a query to servicesNS

splunk:8089/servicesNS/admin/search/authentication/users

In response, I get "You do not have permissions to access objects of user=admin". Also, I tried to search "index=_audit" and "| rest /services/authentication/users" but without success.

How can I get a list of users in Splunk using a USER account without admin access? Maybe JS or REST can help?

Thanks.

Re: How to generate users list without admin access?

gcusello — Wed, 08 Jul 2020 12:33:02 GMT

Hi @rendie ,

if you haven't the grants to execute a REST command, the only hint is to run a search on _internal and extract the users that used Splunk!

index=_audit sourcetype = audittrail action="login attempt" | dedup user | sort user | table user

Ciao.

Giuseppe

Re: How to generate users list without admin access?

richgalloway — Wed, 08 Jul 2020 12:38:17 GMT

Ordinary users are limited in what they are allowed to see. The best you can do is this search

| rest /servicesNS/-/search/authentication/users

Re: How to generate users list without admin access?

rendie — Wed, 08 Jul 2020 13:05:43 GMT

@richgallowayusing your solution in my case, as a result, I get only the current log user. This can be useful only for user with ADMIN permissions. But in any way thank you for your help.

Re: How to generate users list without admin access?

richgalloway — Wed, 08 Jul 2020 13:55:43 GMT

As I said, you are an ordinary user and so are limited in what you may view.

Re: How to generate users list without admin access?

richgalloway — Wed, 08 Jul 2020 13:56:25 GMT

By default, however, users do not have access to _internal.