https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-list-roles-and-their-capabilities-in-a/m-p/248551#M74214 <P>@ jkat54 : It would not let me download the app.. can you please check...</P> Mon, 17 Oct 2016 16:47:56 GMT srikanth1213 2016-10-17T16:47:56Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-list-roles-and-their-capabilities-in-a/m-p/248548#M74211 <P>Hello Guys, </P> <P>Can someone help me with a search to list the roles and their capabilities in a Splunk environment?</P> Fri, 14 Oct 2016 18:17:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-list-roles-and-their-capabilities-in-a/m-p/248548#M74211 srikanth1213 2016-10-14T18:17:59Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-list-roles-and-their-capabilities-in-a/m-p/248549#M74212 <P>Hello, </P> <P>here is a solution for the roles and users from always awesome user "somesoni2"<BR /> <A href="https://answers.splunk.com/answers/127844/how-can-i-generate-a-list-of-users-and-assigned-roles.html">https://answers.splunk.com/answers/127844/how-can-i-generate-a-list-of-users-and-assigned-roles.html</A></P> <P>and with the roles and capabilities thing you are not far off searching with this command:</P> <PRE><CODE> | rest /services/authorization/roles </CODE></PRE> <P>used those myself in the past to get reports about that</P> Fri, 14 Oct 2016 18:25:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-list-roles-and-their-capabilities-in-a/m-p/248549#M74212 horsefez 2016-10-14T18:25:29Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-list-roles-and-their-capabilities-in-a/m-p/248550#M74213 <P>This is an awesome app for that:</P> <P><A href="https://splunkbase.splunk.com/app/1866/">https://splunkbase.splunk.com/app/1866/</A></P> Fri, 14 Oct 2016 20:11:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-list-roles-and-their-capabilities-in-a/m-p/248550#M74213 jkat54 2016-10-14T20:11:29Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-list-roles-and-their-capabilities-in-a/m-p/248551#M74214 <P>@ jkat54 : It would not let me download the app.. can you please check...</P> Mon, 17 Oct 2016 16:47:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-list-roles-and-their-capabilities-in-a/m-p/248551#M74214 srikanth1213 2016-10-17T16:47:56Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-list-roles-and-their-capabilities-in-a/m-p/248552#M74215 <P>Dashboard which will list and compare role capabilities. (XML code below)<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1998i098EE8C2B817AAD0/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <PRE><CODE>&lt;form hideFilters="true"&gt; &lt;label&gt;Role Capabilities&lt;/label&gt; &lt;description&gt;(select roles and capabilities to compare)&lt;/description&gt; &lt;fieldset submitButton="false"&gt; &lt;input type="checkbox" token="role" searchWhenChanged="true"&gt; &lt;label&gt;Roles&lt;/label&gt; &lt;fieldForLabel&gt;role&lt;/fieldForLabel&gt; &lt;fieldForValue&gt;role&lt;/fieldForValue&gt; &lt;search&gt; &lt;query&gt;| rest /services/authentication/users splunk_server=local | table roles | mvexpand roles | dedup roles | table roles | sort roles | rename roles as role&lt;/query&gt; &lt;earliest&gt;-24h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/search&gt; &lt;prefix&gt;(&lt;/prefix&gt; &lt;suffix&gt;)&lt;/suffix&gt; &lt;valuePrefix&gt;role="&lt;/valuePrefix&gt; &lt;valueSuffix&gt;"&lt;/valueSuffix&gt; &lt;delimiter&gt; OR &lt;/delimiter&gt; &lt;choice value="*"&gt;All&lt;/choice&gt; &lt;default&gt;admin,power,sc_admin,user&lt;/default&gt; &lt;/input&gt; &lt;input type="dropdown" token="capability_group" searchWhenChanged="true"&gt; &lt;label&gt;Capability Group&lt;/label&gt; &lt;choice value="*"&gt;All&lt;/choice&gt; &lt;default&gt;*&lt;/default&gt; &lt;prefix&gt;capability_group="&lt;/prefix&gt; &lt;suffix&gt;"&lt;/suffix&gt; &lt;fieldForLabel&gt;capability_group&lt;/fieldForLabel&gt; &lt;fieldForValue&gt;capability_group&lt;/fieldForValue&gt; &lt;search&gt; &lt;query&gt;| rest /services/authorization/roles splunk_server=local | table capabilities | mvexpand capabilities | dedup capabilities | sort capabilities | rex field=capabilities "^(?&lt;capability_group&gt;[^_]+)" | table capability_group | dedup capability_group&lt;/query&gt; &lt;earliest&gt;-24h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/search&gt; &lt;/input&gt; &lt;input type="dropdown" token="capabilities" searchWhenChanged="true"&gt; &lt;label&gt;Capabilities&lt;/label&gt; &lt;choice value="*"&gt;All&lt;/choice&gt; &lt;default&gt;*&lt;/default&gt; &lt;prefix&gt;capabilities="&lt;/prefix&gt; &lt;suffix&gt;"&lt;/suffix&gt; &lt;fieldForLabel&gt;capabilities&lt;/fieldForLabel&gt; &lt;fieldForValue&gt;capabilities&lt;/fieldForValue&gt; &lt;search&gt; &lt;query&gt;| rest /services/authorization/roles splunk_server=local | table capabilities | mvexpand capabilities | dedup capabilities | sort capabilities&lt;/query&gt; &lt;earliest&gt;-24h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/search&gt; &lt;/input&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;Capabilities by Role&lt;/title&gt; &lt;table&gt; &lt;search&gt; &lt;query&gt;| rest /services/authorization/roles splunk_server=local | table capabilities | dedup capabilities | sort capabilities | eval role="Capabilities List" | table capabilities | stats count by role capabilities | appendcols [| rest /services/authorization/roles | table title capabilities | dedup title | rename title as role | table role capabilities | stats count by role capabilities] | eval _time=now() | search $role$ | stats count(eval(capabilities="accelerate_datamodel")) as accelerate_datamodel count(eval(capabilities="accelerate_search")) as accelerate_search count(eval(capabilities="admin_all_objects")) as admin_all_objects count(eval(capabilities="change_authentication")) as change_authentication count(eval(capabilities="change_own_password")) as change_own_password count(eval(capabilities="delete_by_keyword")) as delete_by_keyword count(eval(capabilities="dispatch_rest_to_indexers")) as dispatch_rest_to_indexers count(eval(capabilities="dmc_deploy_apps")) as dmc_deploy_apps count(eval(capabilities="dmc_deploy_token_http")) as dmc_deploy_token_http count(eval(capabilities="edit_cmd")) as edit_cmd count(eval(capabilities="edit_deployment_client")) as edit_deployment_client count(eval(capabilities="edit_deployment_server")) as edit_deployment_server count(eval(capabilities="edit_dist_peer")) as edit_dist_peer count(eval(capabilities="edit_encryption_key_provider")) as edit_encryption_key_provider count(eval(capabilities="edit_forwarders")) as edit_forwarders count(eval(capabilities="edit_httpauths")) as edit_httpauths count(eval(capabilities="edit_indexer_cluster")) as edit_indexer_cluster count(eval(capabilities="edit_indexerdiscovery")) as edit_indexerdiscovery count(eval(capabilities="edit_input_defaults")) as edit_input_defaults count(eval(capabilities="edit_local_apps")) as edit_local_apps count(eval(capabilities="edit_monitor")) as edit_monitor count(eval(capabilities="edit_restmap")) as edit_restmap count(eval(capabilities="edit_roles")) as edit_roles count(eval(capabilities="edit_roles_grantable")) as edit_roles_grantable count(eval(capabilities="edit_scripted")) as edit_scripted count(eval(capabilities="edit_search_head_clustering")) as edit_search_head_clustering count(eval(capabilities="edit_search_schedule_priority")) as edit_search_schedule_priority count(eval(capabilities="edit_search_schedule_window")) as edit_search_schedule_window count(eval(capabilities="edit_search_scheduler")) as edit_search_scheduler count(eval(capabilities="edit_search_server")) as edit_search_server count(eval(capabilities="edit_server")) as edit_server count(eval(capabilities="edit_server_crl")) as edit_server_crl count(eval(capabilities="edit_sourcetypes")) as edit_sourcetypes count(eval(capabilities="edit_splunktcp")) as edit_splunktcp count(eval(capabilities="edit_splunktcp_ssl")) as edit_splunktcp_ssl count(eval(capabilities="edit_splunktcp_token")) as edit_splunktcp_token count(eval(capabilities="edit_statsd_transforms")) as edit_statsd_transforms count(eval(capabilities="edit_tcp")) as edit_tcp count(eval(capabilities="edit_tcp_stream")) as edit_tcp_stream count(eval(capabilities="edit_telemetry_settings")) as edit_telemetry_settings count(eval(capabilities="edit_token_http")) as edit_token_http count(eval(capabilities="edit_udp")) as edit_udp count(eval(capabilities="edit_upload_and_index")) as edit_upload_and_index count(eval(capabilities="edit_user")) as edit_user count(eval(capabilities="edit_view_html")) as edit_view_html count(eval(capabilities="edit_web_settings")) as edit_web_settings count(eval(capabilities="embed_report")) as embed_report count(eval(capabilities="export_results_is_visible")) as export_results_is_visible count(eval(capabilities="get_diag")) as get_diag count(eval(capabilities="get_metadata")) as get_metadata count(eval(capabilities="get_typeahead")) as get_typeahead count(eval(capabilities="indexes_edit")) as indexes_edit count(eval(capabilities="indexes_list_all")) as indexes_list_all count(eval(capabilities="input_file")) as input_file count(eval(capabilities="license_edit")) as license_edit count(eval(capabilities="license_tab")) as license_tab count(eval(capabilities="license_view_warnings")) as license_view_warnings count(eval(capabilities="list_deployment_client")) as list_deployment_client count(eval(capabilities="list_deployment_server")) as list_deployment_server count(eval(capabilities="list_forwarders")) as list_forwarders count(eval(capabilities="list_httpauths")) as list_httpauths count(eval(capabilities="list_indexer_cluster")) as list_indexer_cluster count(eval(capabilities="list_indexerdiscovery")) as list_indexerdiscovery count(eval(capabilities="list_inputs")) as list_inputs count(eval(capabilities="list_introspection")) as list_introspection count(eval(capabilities="list_metrics_catalog")) as list_metrics_catalog count(eval(capabilities="list_search_head_clustering")) as list_search_head_clustering count(eval(capabilities="list_search_scheduler")) as list_search_scheduler count(eval(capabilities="list_settings")) as list_settings count(eval(capabilities="list_storage_passwords")) as list_storage_passwords count(eval(capabilities="output_file")) as output_file count(eval(capabilities="pattern_detect")) as pattern_detect count(eval(capabilities="refresh_application_licenses")) as refresh_application_licenses count(eval(capabilities="request_remote_tok")) as request_remote_tok count(eval(capabilities="rest_apps_management")) as rest_apps_management count(eval(capabilities="rest_apps_view")) as rest_apps_view count(eval(capabilities="rest_properties_get")) as rest_properties_get count(eval(capabilities="rest_properties_set")) as rest_properties_set count(eval(capabilities="restart_reason")) as restart_reason count(eval(capabilities="restart_splunkd")) as restart_splunkd count(eval(capabilities="rtsearch")) as rtsearch count(eval(capabilities="run_debug_commands")) as run_debug_commands count(eval(capabilities="schedule_rtsearch")) as schedule_rtsearch count(eval(capabilities="schedule_search")) as schedule_search count(eval(capabilities="search")) as search count(eval(capabilities="search_process_config_refresh")) as search_process_config_refresh count(eval(capabilities="web_debug")) as web_debug by role | transpose 1000 column_name=capabilities header_field=role | rex field=capabilities "^(?&lt;capability_group&gt;[^_]+)" | search $capabilities$ $capability_group$&lt;/query&gt; &lt;earliest&gt;-24h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;/search&gt; &lt;option name="count"&gt;100&lt;/option&gt; &lt;option name="dataOverlayMode"&gt;none&lt;/option&gt; &lt;option name="drilldown"&gt;none&lt;/option&gt; &lt;option name="percentagesRow"&gt;false&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="rowNumbers"&gt;true&lt;/option&gt; &lt;option name="totalsRow"&gt;false&lt;/option&gt; &lt;option name="wrap"&gt;false&lt;/option&gt; &lt;format type="color" field="admin"&gt; &lt;colorPalette type="map"&gt;{"0":#555555,"1":#A2CC3E}&lt;/colorPalette&gt; &lt;/format&gt; &lt;format type="color" field="apps"&gt; &lt;colorPalette type="map"&gt;{"0":#555555,"1":#A2CC3E}&lt;/colorPalette&gt; &lt;/format&gt; &lt;format type="color" field="capability_group"&gt; &lt;colorPalette type="sharedList"&gt;&lt;/colorPalette&gt; &lt;scale type="sharedCategory"&gt;&lt;/scale&gt; &lt;/format&gt; &lt;format type="color" field="power"&gt; &lt;colorPalette type="map"&gt;{"0":#555555,"1":#A2CC3E}&lt;/colorPalette&gt; &lt;/format&gt; &lt;format type="color" field="sc_admin"&gt; &lt;colorPalette type="map"&gt;{"0":#555555,"1":#A2CC3E}&lt;/colorPalette&gt; &lt;/format&gt; &lt;format type="color" field="user"&gt; &lt;colorPalette type="map"&gt;{"0":#555555,"1":#A2CC3E}&lt;/colorPalette&gt; &lt;/format&gt; &lt;format type="number" field="internal_automation_role"&gt; &lt;option name="precision"&gt;0&lt;/option&gt; &lt;/format&gt; &lt;format type="color" field="internal_automation_role"&gt; &lt;colorPalette type="map"&gt;{"0":#555555,"1":#A2CC3E}&lt;/colorPalette&gt; &lt;/format&gt; &lt;/table&gt; &lt;/panel&gt; &lt;/row&gt; &lt;/form&gt; </CODE></PRE> Thu, 25 Jul 2019 01:35:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-list-roles-and-their-capabilities-in-a/m-p/248552#M74215 bandit 2019-07-25T01:35:41Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-list-roles-and-their-capabilities-in-a/m-p/746256#M241610 <P>Update to the included classic dashboard code taking care of new framework and handling "capability_group" extraction in lines 42 and 91 related to unescaped HTML tags.</P><LI-CODE lang="markup">&lt;form version="1.1" theme="light"&gt; &lt;label&gt;Native Role Capabilities (not inherited)&lt;/label&gt; &lt;description&gt;(select roles and capabilities to compare)&lt;/description&gt; &lt;fieldset submitButton="false"&gt; &lt;input type="checkbox" token="role" searchWhenChanged="true"&gt; &lt;label&gt;Roles&lt;/label&gt; &lt;fieldForLabel&gt;role&lt;/fieldForLabel&gt; &lt;fieldForValue&gt;role&lt;/fieldForValue&gt; &lt;search&gt; &lt;query&gt;| rest /services/authentication/users splunk_server=local | table roles | mvexpand roles | dedup roles | table roles | sort roles | rename roles as role&lt;/query&gt; &lt;earliest&gt;-24h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/search&gt; &lt;prefix&gt;(&lt;/prefix&gt; &lt;suffix&gt;)&lt;/suffix&gt; &lt;valuePrefix&gt;role="&lt;/valuePrefix&gt; &lt;valueSuffix&gt;"&lt;/valueSuffix&gt; &lt;delimiter&gt; OR &lt;/delimiter&gt; &lt;choice value="*"&gt;All&lt;/choice&gt; &lt;default&gt;admin,power,sc_admin,user&lt;/default&gt; &lt;/input&gt; &lt;input type="dropdown" token="capability_group" searchWhenChanged="true"&gt; &lt;label&gt;Capability Group&lt;/label&gt; &lt;choice value="*"&gt;All&lt;/choice&gt; &lt;default&gt;*&lt;/default&gt; &lt;prefix&gt;capability_group="&lt;/prefix&gt; &lt;suffix&gt;"&lt;/suffix&gt; &lt;fieldForLabel&gt;capability_group&lt;/fieldForLabel&gt; &lt;fieldForValue&gt;capability_group&lt;/fieldForValue&gt; &lt;search&gt; &lt;query&gt;| rest /services/authorization/roles splunk_server=local | table capabilities | mvexpand capabilities | dedup capabilities | sort capabilities | rex field=capabilities "^(?&amp;lt;capability_group&amp;gt;[^_]+)" | table capability_group | dedup capability_group&lt;/query&gt; &lt;earliest&gt;-24h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/search&gt; &lt;/input&gt; &lt;input type="dropdown" token="capabilities" searchWhenChanged="true"&gt; &lt;label&gt;Capabilities&lt;/label&gt; &lt;choice value="*"&gt;All&lt;/choice&gt; &lt;default&gt;*&lt;/default&gt; &lt;prefix&gt;capabilities="&lt;/prefix&gt; &lt;suffix&gt;"&lt;/suffix&gt; &lt;fieldForLabel&gt;capabilities&lt;/fieldForLabel&gt; &lt;fieldForValue&gt;capabilities&lt;/fieldForValue&gt; &lt;search&gt; &lt;query&gt;| rest /services/authorization/roles splunk_server=local | table capabilities | mvexpand capabilities | dedup capabilities | sort capabilities&lt;/query&gt; &lt;earliest&gt;-24h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/search&gt; &lt;/input&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;Capabilities by Role&lt;/title&gt; &lt;table&gt; &lt;search&gt; &lt;query&gt;| rest /services/authorization/roles splunk_server=local | table capabilities | dedup capabilities | sort capabilities | eval role="Capabilities List" | table capabilities | stats count by role capabilities | appendcols [| rest /services/authorization/roles | table title capabilities | dedup title | rename title as role | table role capabilities | stats count by role capabilities] | eval _time=now() | search $role$ | stats count(eval(capabilities="accelerate_datamodel")) as accelerate_datamodel count(eval(capabilities="accelerate_search")) as accelerate_search count(eval(capabilities="admin_all_objects")) as admin_all_objects count(eval(capabilities="change_authentication")) as change_authentication count(eval(capabilities="change_own_password")) as change_own_password count(eval(capabilities="delete_by_keyword")) as delete_by_keyword count(eval(capabilities="dispatch_rest_to_indexers")) as dispatch_rest_to_indexers count(eval(capabilities="dmc_deploy_apps")) as dmc_deploy_apps count(eval(capabilities="dmc_deploy_token_http")) as dmc_deploy_token_http count(eval(capabilities="edit_cmd")) as edit_cmd count(eval(capabilities="edit_deployment_client")) as edit_deployment_client count(eval(capabilities="edit_deployment_server")) as edit_deployment_server count(eval(capabilities="edit_dist_peer")) as edit_dist_peer count(eval(capabilities="edit_encryption_key_provider")) as edit_encryption_key_provider count(eval(capabilities="edit_forwarders")) as edit_forwarders count(eval(capabilities="edit_httpauths")) as edit_httpauths count(eval(capabilities="edit_indexer_cluster")) as edit_indexer_cluster count(eval(capabilities="edit_indexerdiscovery")) as edit_indexerdiscovery count(eval(capabilities="edit_input_defaults")) as edit_input_defaults count(eval(capabilities="edit_local_apps")) as edit_local_apps count(eval(capabilities="edit_monitor")) as edit_monitor count(eval(capabilities="edit_restmap")) as edit_restmap count(eval(capabilities="edit_roles")) as edit_roles count(eval(capabilities="edit_roles_grantable")) as edit_roles_grantable count(eval(capabilities="edit_scripted")) as edit_scripted count(eval(capabilities="edit_search_head_clustering")) as edit_search_head_clustering count(eval(capabilities="edit_search_schedule_priority")) as edit_search_schedule_priority count(eval(capabilities="edit_search_schedule_window")) as edit_search_schedule_window count(eval(capabilities="edit_search_scheduler")) as edit_search_scheduler count(eval(capabilities="edit_search_server")) as edit_search_server count(eval(capabilities="edit_server")) as edit_server count(eval(capabilities="edit_server_crl")) as edit_server_crl count(eval(capabilities="edit_sourcetypes")) as edit_sourcetypes count(eval(capabilities="edit_splunktcp")) as edit_splunktcp count(eval(capabilities="edit_splunktcp_ssl")) as edit_splunktcp_ssl count(eval(capabilities="edit_splunktcp_token")) as edit_splunktcp_token count(eval(capabilities="edit_statsd_transforms")) as edit_statsd_transforms count(eval(capabilities="edit_tcp")) as edit_tcp count(eval(capabilities="edit_tcp_stream")) as edit_tcp_stream count(eval(capabilities="edit_telemetry_settings")) as edit_telemetry_settings count(eval(capabilities="edit_token_http")) as edit_token_http count(eval(capabilities="edit_udp")) as edit_udp count(eval(capabilities="edit_upload_and_index")) as edit_upload_and_index count(eval(capabilities="edit_user")) as edit_user count(eval(capabilities="edit_view_html")) as edit_view_html count(eval(capabilities="edit_web_settings")) as edit_web_settings count(eval(capabilities="embed_report")) as embed_report count(eval(capabilities="export_results_is_visible")) as export_results_is_visible count(eval(capabilities="get_diag")) as get_diag count(eval(capabilities="get_metadata")) as get_metadata count(eval(capabilities="get_typeahead")) as get_typeahead count(eval(capabilities="indexes_edit")) as indexes_edit count(eval(capabilities="indexes_list_all")) as indexes_list_all count(eval(capabilities="input_file")) as input_file count(eval(capabilities="license_edit")) as license_edit count(eval(capabilities="license_tab")) as license_tab count(eval(capabilities="license_view_warnings")) as license_view_warnings count(eval(capabilities="list_deployment_client")) as list_deployment_client count(eval(capabilities="list_deployment_server")) as list_deployment_server count(eval(capabilities="list_forwarders")) as list_forwarders count(eval(capabilities="list_httpauths")) as list_httpauths count(eval(capabilities="list_indexer_cluster")) as list_indexer_cluster count(eval(capabilities="list_indexerdiscovery")) as list_indexerdiscovery count(eval(capabilities="list_inputs")) as list_inputs count(eval(capabilities="list_introspection")) as list_introspection count(eval(capabilities="list_metrics_catalog")) as list_metrics_catalog count(eval(capabilities="list_search_head_clustering")) as list_search_head_clustering count(eval(capabilities="list_search_scheduler")) as list_search_scheduler count(eval(capabilities="list_settings")) as list_settings count(eval(capabilities="list_storage_passwords")) as list_storage_passwords count(eval(capabilities="output_file")) as output_file count(eval(capabilities="pattern_detect")) as pattern_detect count(eval(capabilities="refresh_application_licenses")) as refresh_application_licenses count(eval(capabilities="request_remote_tok")) as request_remote_tok count(eval(capabilities="rest_apps_management")) as rest_apps_management count(eval(capabilities="rest_apps_view")) as rest_apps_view count(eval(capabilities="rest_properties_get")) as rest_properties_get count(eval(capabilities="rest_properties_set")) as rest_properties_set count(eval(capabilities="restart_reason")) as restart_reason count(eval(capabilities="restart_splunkd")) as restart_splunkd count(eval(capabilities="rtsearch")) as rtsearch count(eval(capabilities="run_debug_commands")) as run_debug_commands count(eval(capabilities="schedule_rtsearch")) as schedule_rtsearch count(eval(capabilities="schedule_search")) as schedule_search count(eval(capabilities="search")) as search count(eval(capabilities="search_process_config_refresh")) as search_process_config_refresh count(eval(capabilities="web_debug")) as web_debug by role | transpose 1000 column_name=capabilities header_field=role | rex field=capabilities "^(?&amp;lt;capability_group&amp;gt;[^_]+)" | search $capabilities$ $capability_group$&lt;/query&gt; &lt;earliest&gt;-24h@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;/search&gt; &lt;option name="count"&gt;100&lt;/option&gt; &lt;option name="dataOverlayMode"&gt;none&lt;/option&gt; &lt;option name="drilldown"&gt;none&lt;/option&gt; &lt;option name="percentagesRow"&gt;false&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="rowNumbers"&gt;true&lt;/option&gt; &lt;option name="totalsRow"&gt;false&lt;/option&gt; &lt;option name="wrap"&gt;false&lt;/option&gt; &lt;format type="color" field="admin"&gt; &lt;colorPalette type="map"&gt;{"0":#555555,"1":#A2CC3E}&lt;/colorPalette&gt; &lt;/format&gt; &lt;format type="color" field="apps"&gt; &lt;colorPalette type="map"&gt;{"0":#555555,"1":#A2CC3E}&lt;/colorPalette&gt; &lt;/format&gt; &lt;format type="color" field="capability_group"&gt; &lt;colorPalette type="sharedList"&gt;&lt;/colorPalette&gt; &lt;scale type="sharedCategory"&gt;&lt;/scale&gt; &lt;/format&gt; &lt;format type="color" field="power"&gt; &lt;colorPalette type="map"&gt;{"0":#555555,"1":#A2CC3E}&lt;/colorPalette&gt; &lt;/format&gt; &lt;format type="color" field="sc_admin"&gt; &lt;colorPalette type="map"&gt;{"0":#555555,"1":#A2CC3E}&lt;/colorPalette&gt; &lt;/format&gt; &lt;format type="color" field="user"&gt; &lt;colorPalette type="map"&gt;{"0":#555555,"1":#A2CC3E}&lt;/colorPalette&gt; &lt;/format&gt; &lt;format type="number" field="internal_automation_role"&gt; &lt;option name="precision"&gt;0&lt;/option&gt; &lt;/format&gt; &lt;format type="color" field="internal_automation_role"&gt; &lt;colorPalette type="map"&gt;{"0":#555555,"1":#A2CC3E}&lt;/colorPalette&gt; &lt;/format&gt; &lt;/table&gt; &lt;/panel&gt; &lt;/row&gt; &lt;/form&gt;</LI-CODE><P>&nbsp;</P> Thu, 15 May 2025 14:31:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-list-roles-and-their-capabilities-in-a/m-p/746256#M241610 99eaglez 2025-05-15T14:31:51Z