topic Re: Is there a search or other way to easily list the indexes I am permissioned to search? in Splunk Search

Is there a search or other way to easily list the indexes I am permissioned to search?

juniormint — Thu, 24 Oct 2013 13:11:47 GMT

I have a multiple index system where some roles can search some indexes and other roles other indexes. My personal user has several roles with access to multiple indexes. There are enough of them that I sometimes want to review the list for reference.

Is there a search or some other nice way to the list of indexes I am allowed to search?

Re: Is there a search or other way to easily list the indexes I am permissioned to search?

kristian_kolb — Thu, 24 Oct 2013 13:30:24 GMT

I guess that going into the manager is not the answer you want. 🙂

| rest /services/admin/roles | table title, srchIndexesAllowed | rename title as role

could be what you want? I don't think very restricted roles can perform this search, but the ordinary user role can find out it's permissions.

Re: Is there a search or other way to easily list the indexes I am permissioned to search?

alacercogitatus — Thu, 24 Oct 2013 13:37:47 GMT

I'll do one better, I do this everyday, so when I have to check I can just "|inputlookup user_authorizations.csv | search username=$USER". This might not work if you don't have permissions on the endpoints.

Re: Is there a search or other way to easily list the indexes I am permissioned to search?

gkanapathy — Thu, 24 Oct 2013 14:56:19 GMT

For a specific user, the easiest and fastest is:

| eventcount summarize=f index=_* index=* | stats count by index

Every user can run this from search, so you don't need access to rest. On the other hand, you can't get this information for another user using this method. It will include indexes that are empty as well.

Re: Is there a search or other way to easily list the indexes I am permissioned to search?

lukejadamec — Thu, 24 Oct 2013 23:42:45 GMT

How do you get this search to work?
I'm running Splunk 5.0.2 as admin and when I run this search it yields No Results.

Re: Is there a search or other way to easily list the indexes I am permissioned to search?

lukejadamec — Thu, 24 Oct 2013 23:48:51 GMT

All of these answers are pretty useless without permissions some other Splunk magic.

This search will give you a list of indexes you have permissions to search, but it will take a few minutes to run, and will only capture indexes that were active in the time frame of the search.
The best part is, it will for Anyone with permission to Search.

index="*" OR index="_*" | dedup index | table index

Re: Is there a search or other way to easily list the indexes I am permissioned to search?

gkanapathy — Fri, 25 Oct 2013 00:01:41 GMT

I enter it exactly as is in the search bar. It has worked for me in every version from 4.1 or so till now.

Re: Is there a search or other way to easily list the indexes I am permissioned to search?

gkanapathy — Fri, 25 Oct 2013 00:05:23 GMT

And just to be clear, the eventcount command does not require any special permissions. It is the same command that was used on the Splunk 4.x and 5.x pages to display the total numbers of events on the search app overview page.

Re: Is there a search or other way to easily list the indexes I am permissioned to search?

lukejadamec — Fri, 25 Oct 2013 00:05:52 GMT

Thanks, I guess I figured the pipe in the beginning was assuming a preceding string. It was much faster than my search.

Re: Is there a search or other way to easily list the indexes I am permissioned to search?

alacercogitatus — Fri, 25 Oct 2013 11:27:03 GMT

please accept the answer that has answered your question most completely.

Re: Is there a search or other way to easily list the indexes I am permissioned to search?

kristian_kolb — Mon, 28 Oct 2013 21:15:49 GMT

juniormint. you have a few different answers to choose from. Did either one work especially well for you?

Re: Is there a search or other way to easily list the indexes I am permissioned to search?

juniormint — Tue, 05 Nov 2013 01:50:30 GMT

For my purposes this seems like the simplest and it is very quick to return. Thanks! @gkanapathy

Re: Is there a search or other way to easily list the indexes I am permissioned to search?

juniormint — Tue, 05 Nov 2013 01:53:06 GMT

@gkanapathy gave what seems to me the simplest, performant answer, so thanks! Love all the other answers too with diff takes on it.