topic Re: Query for Users, Roles, AD Groups and Indexes. in Splunk Search

Query for Users, Roles, AD Groups and Indexes.

aknsun — Thu, 19 Sep 2019 05:24:05 GMT

Hi,

I'm trying to get the query to pull out the following, but struggling a bit with all the joins. I need to get a list of the following in a report.

List of users
The Roles each user is part of.
The AD Group that each user is part of.
The Indexes that each user has access to.

Looks like I will need to be using the below 4 endpoints.

/services/authentication/users
/services/authorization/roles
/services/admin/LDAP-groups
/services/data/indexes

Re: Query for Users, Roles, AD Groups and Indexes.

harsmarvania57 — Thu, 19 Sep 2019 08:49:11 GMT

Hi,

Try below query on Search Head, not sure whether it will give you all information which you require. It is working fine in my lab environment (Which has very few users)

| rest splunk_server=local /services/authentication/users
| fields title, roles
| mvexpand roles
| append [ | rest splunk_server=local /services/authorization/roles
           | fields imported_roles,imported_srchIndexesAllowed,imported_srchIndexesDefault,srchIndexesAllowed,srchIndexesDefault,title
           | rename title as roles]
| append [ | rest splunk_server=local /services/admin/LDAP-groups
           | fields roles,title
           | rename title as ADGroup]
| stats values(imported_roles) as imported_roles, values(imported_srchIndexesAllowed) as imported_srchIndexesAllowed, values(imported_srchIndexesDefault) as imported_srchIndexesDefault, values(srchIndexesAllowed) as srchIndexesAllowed, values(srchIndexesDefault) as srchIndexesDefault, values(title) as userid, values(ADGroup) as ADGroup by roles
| mvexpand userid
| stats values(imported_roles) as imported_roles, values(imported_srchIndexesAllowed) as imported_srchIndexesAllowed, values(imported_srchIndexesDefault) as imported_srchIndexesDefault, values(srchIndexesAllowed) as srchIndexesAllowed, values(srchIndexesDefault) as srchIndexesDefault, values(roles) as roles, values(ADGroup) as ADGroup by userid

Re: Query for Users, Roles, AD Groups and Indexes.

aknsun — Fri, 20 Sep 2019 05:53:51 GMT

HI @harsmarvania57. Thanks for the query. I had to make a small change to get it working by adding the following in the 3rd line

| rename title as userid

and including it in the stats

Re: Query for Users, Roles, AD Groups and Indexes.

sriniwf — Thu, 18 Mar 2021 11:50:43 GMT

It's not working for our environment. Do we have any alternative query for this.

Actually in LDAP rest api query , we are only getting admin, user,power , splunk-system-user roles i'm getting.. Due to that, i'm not getting proper results.

can you please help me.