Getting Data In

Create user and grant him search privilege on a specific index with cURL


Hi guys,

I'm trying to create a user and only grant him search privileges on a specific index using cURL. So far I used these two commands:
Index creation:

curl -k -u admin:password https://SplunkIP:8089/servicesNS/admin/search/data/indexes -d name=mytest

And I found this command example for the user creation:

curl -k -u admin:password https://SplunkIP:8089/services/authentication/users -d name=User1 -d password=changeme -d roles=role

So as far, as I understood, I can directly affect an existing role while creating the User1 account, but I would like to create a specific role which allows him to only read and search from the mytest index.

I found a "createrole" parameter for the last cURL, but it's not clear from the documentation.

So is it possible to create / specify the role while creating a new user? Or is there any other cURL command which can create a role?

Thank you very much !

0 Karma


Create a role
And Attach your filter to that role...

Check.. [role_<< roleName >>] --> srchFilter in

Give your filter in the field Restrict search terms in UI while creating role

And Assign that role to your User

0 Karma

Revered Legend

You can create a role for the user but not sure if you can customize the role that way. Better option is to create the role separately (before creating user) with all the customization (index access) and then assign that role to the user while creating (or update if already created). See this link for roles creation curl using Splunk REST API

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!