Splunk Java SDK is not working based on splunk role/index defined for the user

angelinealex — Tue, 29 Sep 2020 19:27:41 GMT

I am using Splunk Java SDK to fetch data from Splunk index.

I have the below in my splunk server.
User - Customer_1_User1
Role - customer1_role (which have access to only customer1_index)
Saved Search Name - test_savedsearch

I am connecting to splunk from the java application (using Splunk Java SDK) using below code snippet

    loginArgs.setUsername("Customer_1_User1"));             
    loginArgs.setPassword("xxxx"));                 
    loginArgs.setHost("splunkHostName"));                                   
    loginArgs.setPort(8059);
    Service splunkService = Service.connect(loginArgs)

    //Get the earliest and latest time
SavedSearchDispatchArgs savedSearchDispatchArgs = getEarliestAndLatestTime();

SavedSearchCollection savedSearches = splunkService.getSavedSearches();
SavedSearch savedSearch = splunkService.getSavedSearches().get("test_savedsearch");
Job jobSavedSearch = savedSearch.dispatch(savedSearchDispatchArgs);
Map<String, Object> arguments = new HashMap<String, Object>();
arguments.put("count", 0);
InputStream resultsNormalSearch = jobSavedSearch.getResults(arguments);
ResultsReaderXml resultsReaderNormalSearch = new ResultsReaderXml(resultsNormalSearch);

//fetch data from resultsReaderNormalSearch

When I am trying to fetch data from test_savedsearch through java its returning 500 records.

'customer1_index' has 150 records only. Its fetching 150 records properly when I run the saved search in splunk.

Why its fetching all data through java application irrespective of roles/index defined to the user??

Please help to resolve this issue.

Re: Splunk Java SDK is not working based on splunk role/index defined for the user

xpac — Fri, 11 May 2018 00:11:09 GMT

Please add the lines of code where you actually start the search, fetch the results etc.

Re: Splunk Java SDK is not working based on splunk role/index defined for the user

angelinealex — Fri, 11 May 2018 16:12:43 GMT

updated my code. Please have a look.

topic Re: Splunk Java SDK is not working based on splunk role/index defined for the user in Reporting

Splunk Java SDK is not working based on splunk role/index defined for the user

Re: Splunk Java SDK is not working based on splunk role/index defined for the user

Re: Splunk Java SDK is not working based on splunk role/index defined for the user