Debugging filter strings used with role-based access

[sowings]

I'd like to restrict a certain group of users to only see a specific set of hosts within
an index. I can set up the filtering strings using the Roles page of the Splunk Manager.
Now I need to change that filter string, or perhaps my user has said that they can't
see the results they expect.

How can I triage the filter string tied to a role? Is there some log file somewhere that
logs the string that was applied (i.e., that logs the whole search string)? The user's
search history doesn't seem to contain the filter strings. Furthermore, if I'm using
ActiveDirectory for the user authentication, is there any caching of the role data,
specifically the filter strings themselves?

[somesoni2]

Another option to see list of search filters associated with users/roles is using REST APIs. This could be a starting point. List all the users, their corresponding roles and search filters.

| rest /services/authentication/users | table title, roles | mvexpand roles | join roles [| rest /services/authorization/roles | table title, srchFilter | rename title as roles] | stats values(roles) as roles, values(srchFilter) as SearchFilters by title

[alacercogitatus]

You can try the steps here: http://docs.splunk.com/Documentation/Splunk/6.0.1/Troubleshooting/Enabledebuglogging to enable DEBUG logging. I think you might find it there. You can set "category.QueryLanguageParser=DEBUG" in $SPLUNK_HOME/etc/log.cfg and then check the Job Inspector. It will state which filter string was used. Should narrow down your search a bit.

[alacercogitatus]

How'd it work out?

[sowings]

Thanks. I'll give this a try and get back to you with the extra karma.

[sowings]

I'll give an extra 20 karma to a working answer to this. Double score!