https://community.splunk.com/t5/Splunk-Search/How-to-search-for-which-user-has-access-to-what-index/m-p/66356#M16485 <P>Great thanks - i wonder why this isn't working though:</P> <P>|rest /services/authentication/users splunk_server=local <BR /> |fields title roles realname<BR /> | mvexpand roles<BR /> | append [| rest /services/authorization/roles | table title srchIndexesAllowed<BR /> | rename title as roles<BR /> | mvexpand srchIndexesAllowed]<BR /> | stats list(*) as * by title, realname</P> <P>Once i do the stats list i loos the srchIndexesAllowed column- any ideas?</P> Fri, 13 Apr 2018 07:19:52 GMT claudio_manig 2018-04-13T07:19:52Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-which-user-has-access-to-what-index/m-p/66351#M16480 <P>Does anyone know how to:</P> <P>1) search for which user has what access to the index?<BR /> 2) who has accessed to what index within like the last 24 hours?</P> Mon, 17 Jun 2013 22:37:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-which-user-has-access-to-what-index/m-p/66351#M16480 splunkIT 2013-06-17T22:37:36Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-which-user-has-access-to-what-index/m-p/66352#M16481 <P>1) The following search will return a list of all known users as well as a semicolon-separated list of the indexes they have access to:<BR /><BR /> <CODE><BR /> | rest /services/authentication/users<BR /> | rename title AS username roles AS role<BR /> | mvexpand role<BR /> | fields realname username role<BR /> | join type=outer role [<BR /> rest /services/authorization/roles<BR /> | rename title AS role | eval indexes=mvjoin(srchIndexesAllowed," ; ")<BR /> | fields role indexes]<BR /> | table realname username role indexes<BR /> </CODE></P> <P>A few caveats:</P> <UL> <LI>You need to be admin to run this search</LI> <LI>Wildcards used to define list of indexes will not be expanded. "*" means "all non-internal indexes", "_*" means "all internal indexes".</LI> <LI>If you expect to return more than 1,000 users from your LDAP/AD groups, you might want to read <A href="http://splunk-base.splunk.com/answers/76474/how-to-load-more-than-1000-records-from-ldap">this Splunk Answer</A>.</LI> </UL> <P>2) This is a rather difficult mapping to establish as search strings are recorded without an expanded list of accessed indexes in the _audit events.</P> Mon, 17 Jun 2013 22:46:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-which-user-has-access-to-what-index/m-p/66352#M16481 hexx 2013-06-17T22:46:35Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-which-user-has-access-to-what-index/m-p/66353#M16482 <P>I have the same question. I would be interested to know if the past two years has brought around a way to improve this answer? </P> <P>A way to get the same information without using a rest call that only the admin can do.</P> Tue, 26 May 2015 11:28:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-which-user-has-access-to-what-index/m-p/66353#M16482 lassel 2015-05-26T11:28:22Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-which-user-has-access-to-what-index/m-p/66354#M16483 <P>And perhaps a way to expand the wildcards in indexes.</P> Tue, 26 May 2015 11:36:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-which-user-has-access-to-what-index/m-p/66354#M16483 lassel 2015-05-26T11:36:13Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-which-user-has-access-to-what-index/m-p/66355#M16484 <P>Why not put the results in a csv? <BR /> Scheduled search could take care of this. The csv access can then be set to whatever you want.</P> Fri, 29 Jul 2016 15:35:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-which-user-has-access-to-what-index/m-p/66355#M16484 JohanDB 2016-07-29T15:35:15Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-which-user-has-access-to-what-index/m-p/66356#M16485 <P>Great thanks - i wonder why this isn't working though:</P> <P>|rest /services/authentication/users splunk_server=local <BR /> |fields title roles realname<BR /> | mvexpand roles<BR /> | append [| rest /services/authorization/roles | table title srchIndexesAllowed<BR /> | rename title as roles<BR /> | mvexpand srchIndexesAllowed]<BR /> | stats list(*) as * by title, realname</P> <P>Once i do the stats list i loos the srchIndexesAllowed column- any ideas?</P> Fri, 13 Apr 2018 07:19:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-which-user-has-access-to-what-index/m-p/66356#M16485 claudio_manig 2018-04-13T07:19:52Z