Getting Data In

Debugging filter strings used with role-based access

sowings
Splunk Employee
Splunk Employee

I'd like to restrict a certain group of users to only see a specific set of hosts within
an index. I can set up the filtering strings using the Roles page of the Splunk Manager.
Now I need to change that filter string, or perhaps my user has said that they can't
see the results they expect.

How can I triage the filter string tied to a role? Is there some log file somewhere that
logs the string that was applied (i.e., that logs the whole search string)? The user's
search history doesn't seem to contain the filter strings. Furthermore, if I'm using
ActiveDirectory for the user authentication, is there any caching of the role data,
specifically the filter strings themselves?

somesoni2
Revered Legend

Another option to see list of search filters associated with users/roles is using REST APIs. This could be a starting point. List all the users, their corresponding roles and search filters.

| rest /services/authentication/users | table title, roles | mvexpand roles | join roles [| rest /services/authorization/roles | table title, srchFilter | rename title as roles] | stats values(roles) as roles, values(srchFilter) as SearchFilters by title

alacercogitatus
SplunkTrust
SplunkTrust

You can try the steps here: http://docs.splunk.com/Documentation/Splunk/6.0.1/Troubleshooting/Enabledebuglogging to enable DEBUG logging. I think you might find it there. You can set "category.QueryLanguageParser=DEBUG" in $SPLUNK_HOME/etc/log.cfg and then check the Job Inspector. It will state which filter string was used. Should narrow down your search a bit.

alacercogitatus
SplunkTrust
SplunkTrust

How'd it work out?

0 Karma

sowings
Splunk Employee
Splunk Employee

Thanks. I'll give this a try and get back to you with the extra karma.

0 Karma

sowings
Splunk Employee
Splunk Employee

I'll give an extra 20 karma to a working answer to this. Double score!

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...