topic Re: In Splunk Enterprise, I use |rest /services/authentication/users/ to get a list of users. How can I do the same in Splunk-ES? in Splunk Enterprise Security

In Splunk Enterprise, I use |rest /services/authentication/users/ to get a list of users. How can I do the same in Splunk-ES?

dcrooks_cbp — Mon, 20 Aug 2018 22:24:54 GMT

I need a list of admins and also users from Splunk-ES to list in an audit dashboard.

Re: In Splunk Enterprise, I use |rest /services/authentication/users/ to get a list of users. How can I do the same in Splunk-ES?

richgalloway — Tue, 21 Aug 2018 12:23:53 GMT

Since Splunk ES is built on core Splunk, the same command can be used. To isolate the ES users, look for role names beginning with "ess_".

| rest /services/authentication/users | search roles="ess_*" | dedup title

Re: In Splunk Enterprise, I use |rest /services/authentication/users/ to get a list of users. How can I do the same in Splunk-ES?

dcrooks_cbp — Tue, 21 Aug 2018 12:58:19 GMT

Thanks for the reply!

That command works for me in Splunk-ES, but not in Splunk Enterprise.

Re: In Splunk Enterprise, I use |rest /services/authentication/users/ to get a list of users. How can I do the same in Splunk-ES?

richgalloway — Tue, 21 Aug 2018 13:35:57 GMT

You asked for a command that works in Splunk ES and now you have one.
The same query will work in Splunk Enterprise if you remove the search command.

Re: In Splunk Enterprise, I use |rest /services/authentication/users/ to get a list of users. How can I do the same in Splunk-ES?

dcrooks_cbp — Wed, 22 Aug 2018 12:36:33 GMT

Guess my question is wrong. I need a list of Splunk-ES users from Splunk Enterprise.

When I run that rest command from Splunk Enterprise, I do not see any Splunk-ES users even when I remove the search command.

Re: In Splunk Enterprise, I use |rest /services/authentication/users/ to get a list of users. How can I do the same in Splunk-ES?

richgalloway — Thu, 23 Aug 2018 13:04:05 GMT

Do you have ES users registered on the Enterprise system where you run the query? If not, that would explain why they're not found.

Re: In Splunk Enterprise, I use |rest /services/authentication/users/ to get a list of users. How can I do the same in Splunk-ES?

dcrooks_cbp — Thu, 23 Aug 2018 13:38:46 GMT

How do I get them registered? I should be able to get a list of users in Splunk-ES, yes?

Re: In Splunk Enterprise, I use |rest /services/authentication/users/ to get a list of users. How can I do the same in Splunk-ES?

richgalloway — Mon, 27 Aug 2018 11:47:00 GMT

You can register the ES users like you would any other user, but a non-ES instance won't have the ES roles that identify the users as being part of ES.