https://community.splunk.com/t5/Getting-Data-In/Debugging-filter-strings-used-with-role-based-access/m-p/63655#M12798 <P>I'd like to restrict a certain group of users to only see a specific set of hosts within<BR /> an index. I can set up the filtering strings using the Roles page of the Splunk Manager.<BR /> Now I need to change that filter string, or perhaps my user has said that they can't<BR /> see the results they expect.</P> <P>How can I triage the filter string tied to a role? Is there some log file somewhere that<BR /> logs the string that was applied (i.e., that logs the whole search string)? The user's<BR /> search history doesn't seem to contain the filter strings. Furthermore, if I'm using<BR /> ActiveDirectory for the user authentication, is there any caching of the role data,<BR /> specifically the filter strings themselves?</P> Fri, 15 Mar 2013 20:16:48 GMT sowings 2013-03-15T20:16:48Z https://community.splunk.com/t5/Getting-Data-In/Debugging-filter-strings-used-with-role-based-access/m-p/63655#M12798 <P>I'd like to restrict a certain group of users to only see a specific set of hosts within<BR /> an index. I can set up the filtering strings using the Roles page of the Splunk Manager.<BR /> Now I need to change that filter string, or perhaps my user has said that they can't<BR /> see the results they expect.</P> <P>How can I triage the filter string tied to a role? Is there some log file somewhere that<BR /> logs the string that was applied (i.e., that logs the whole search string)? The user's<BR /> search history doesn't seem to contain the filter strings. Furthermore, if I'm using<BR /> ActiveDirectory for the user authentication, is there any caching of the role data,<BR /> specifically the filter strings themselves?</P> Fri, 15 Mar 2013 20:16:48 GMT https://community.splunk.com/t5/Getting-Data-In/Debugging-filter-strings-used-with-role-based-access/m-p/63655#M12798 sowings 2013-03-15T20:16:48Z https://community.splunk.com/t5/Getting-Data-In/Debugging-filter-strings-used-with-role-based-access/m-p/63656#M12799 <P>I'll give an extra 20 karma to a working answer to this. Double score!</P> Tue, 27 Aug 2013 15:51:03 GMT https://community.splunk.com/t5/Getting-Data-In/Debugging-filter-strings-used-with-role-based-access/m-p/63656#M12799 sowings 2013-08-27T15:51:03Z https://community.splunk.com/t5/Getting-Data-In/Debugging-filter-strings-used-with-role-based-access/m-p/63657#M12800 <P>You can try the steps here: <CODE><A href="http://docs.splunk.com/Documentation/Splunk/6.0.1/Troubleshooting/Enabledebuglogging" target="test_blank">http://docs.splunk.com/Documentation/Splunk/6.0.1/Troubleshooting/Enabledebuglogging</A></CODE> to enable DEBUG logging. I think you might find it there. You can set "category.QueryLanguageParser=DEBUG" in <CODE>$SPLUNK_HOME/etc/log.cfg</CODE> and then check the Job Inspector. It will state which filter string was used. Should narrow down your search a bit.</P> Tue, 07 Jan 2014 17:08:37 GMT https://community.splunk.com/t5/Getting-Data-In/Debugging-filter-strings-used-with-role-based-access/m-p/63657#M12800 alacercogitatus 2014-01-07T17:08:37Z https://community.splunk.com/t5/Getting-Data-In/Debugging-filter-strings-used-with-role-based-access/m-p/63658#M12801 <P>Thanks. I'll give this a try and get back to you with the extra karma.</P> Tue, 07 Jan 2014 18:28:38 GMT https://community.splunk.com/t5/Getting-Data-In/Debugging-filter-strings-used-with-role-based-access/m-p/63658#M12801 sowings 2014-01-07T18:28:38Z https://community.splunk.com/t5/Getting-Data-In/Debugging-filter-strings-used-with-role-based-access/m-p/63659#M12802 <P>How'd it work out?</P> Mon, 13 Jan 2014 15:06:20 GMT https://community.splunk.com/t5/Getting-Data-In/Debugging-filter-strings-used-with-role-based-access/m-p/63659#M12802 alacercogitatus 2014-01-13T15:06:20Z https://community.splunk.com/t5/Getting-Data-In/Debugging-filter-strings-used-with-role-based-access/m-p/63660#M12803 <P>Another option to see list of search filters associated with users/roles is using REST APIs. This could be a starting point. List all the users, their corresponding roles and search filters.</P> <PRE><CODE>| rest /services/authentication/users | table title, roles | mvexpand roles | join roles [| rest /services/authorization/roles | table title, srchFilter | rename title as roles] | stats values(roles) as roles, values(srchFilter) as SearchFilters by title </CODE></PRE> Mon, 13 Jan 2014 16:56:30 GMT https://community.splunk.com/t5/Getting-Data-In/Debugging-filter-strings-used-with-role-based-access/m-p/63660#M12803 somesoni2 2014-01-13T16:56:30Z