https://community.splunk.com/t5/Splunk-Search/Report-on-users-roles/m-p/71841#M17957 <P>Thanks for looking into this.</P> Wed, 21 Sep 2011 16:02:04 GMT chris 2011-09-21T16:02:04Z https://community.splunk.com/t5/Splunk-Search/Report-on-users-roles/m-p/71836#M17952 <P>Is there an easy way I can list &amp; export all users that have a certain role or that have access to a certain index or a certain capability?</P> <P>It would be nice if I could do something like:<BR /><BR /> <PRE><CODE>| metadata type=users</CODE></PRE><BR /> or<BR /> <PRE><CODE>index=_users role=xy </CODE></PRE><BR /> or any other method would be ok</P> Thu, 08 Sep 2011 07:34:18 GMT https://community.splunk.com/t5/Splunk-Search/Report-on-users-roles/m-p/71836#M17952 chris 2011-09-08T07:34:18Z https://community.splunk.com/t5/Splunk-Search/Report-on-users-roles/m-p/71837#M17953 <P>The following search will show you what capabilities each user has used within the timeframe that you set:</P> <P><CODE>index=_audit user=* action=* | dedup user action | stats list(action) AS actions by user</CODE></P> Tue, 13 Sep 2011 10:14:55 GMT https://community.splunk.com/t5/Splunk-Search/Report-on-users-roles/m-p/71837#M17953 Ant1D 2011-09-13T10:14:55Z https://community.splunk.com/t5/Splunk-Search/Report-on-users-roles/m-p/71838#M17954 <P>Thank you for your answer. It kind of helps. I guess the real requirement behind my question is the following: The owner of some data that is in Splunk wants to know who had access to "his" data (=index) at a specific point in time and if the person has read only or also delete priviledges &amp; what priviledges have been used. So you answer helps in showing what priviledges have been used. But I would also like to have a index to role to user mapping ... does that make sense?</P> Wed, 14 Sep 2011 09:25:49 GMT https://community.splunk.com/t5/Splunk-Search/Report-on-users-roles/m-p/71838#M17954 chris 2011-09-14T09:25:49Z https://community.splunk.com/t5/Splunk-Search/Report-on-users-roles/m-p/71839#M17955 <P>Makes sense. I will have a go when I get a minute.</P> Wed, 14 Sep 2011 13:00:10 GMT https://community.splunk.com/t5/Splunk-Search/Report-on-users-roles/m-p/71839#M17955 Ant1D 2011-09-14T13:00:10Z https://community.splunk.com/t5/Splunk-Search/Report-on-users-roles/m-p/71840#M17956 <P>I had a look at this earlier today. I haven't had much luck. There doesn't appear to be a straightforward way of achieving this format of mapping.</P> Wed, 21 Sep 2011 10:41:46 GMT https://community.splunk.com/t5/Splunk-Search/Report-on-users-roles/m-p/71840#M17956 Ant1D 2011-09-21T10:41:46Z https://community.splunk.com/t5/Splunk-Search/Report-on-users-roles/m-p/71841#M17957 <P>Thanks for looking into this.</P> Wed, 21 Sep 2011 16:02:04 GMT https://community.splunk.com/t5/Splunk-Search/Report-on-users-roles/m-p/71841#M17957 chris 2011-09-21T16:02:04Z