Getting Data In
Highlighted

Debugging filter strings used with role-based access

Splunk Employee
Splunk Employee

I'd like to restrict a certain group of users to only see a specific set of hosts within
an index. I can set up the filtering strings using the Roles page of the Splunk Manager.
Now I need to change that filter string, or perhaps my user has said that they can't
see the results they expect.

How can I triage the filter string tied to a role? Is there some log file somewhere that
logs the string that was applied (i.e., that logs the whole search string)? The user's
search history doesn't seem to contain the filter strings. Furthermore, if I'm using
ActiveDirectory for the user authentication, is there any caching of the role data,
specifically the filter strings themselves?

Highlighted

Re: Debugging filter strings used with role-based access

Splunk Employee
Splunk Employee

I'll give an extra 20 karma to a working answer to this. Double score!

0 Karma
Highlighted

Re: Debugging filter strings used with role-based access

SplunkTrust
SplunkTrust

You can try the steps here: http://docs.splunk.com/Documentation/Splunk/6.0.1/Troubleshooting/Enabledebuglogging to enable DEBUG logging. I think you might find it there. You can set "category.QueryLanguageParser=DEBUG" in $SPLUNK_HOME/etc/log.cfg and then check the Job Inspector. It will state which filter string was used. Should narrow down your search a bit.

Highlighted

Re: Debugging filter strings used with role-based access

Splunk Employee
Splunk Employee

Thanks. I'll give this a try and get back to you with the extra karma.

0 Karma
Highlighted

Re: Debugging filter strings used with role-based access

SplunkTrust
SplunkTrust

How'd it work out?

0 Karma
Highlighted

Re: Debugging filter strings used with role-based access

SplunkTrust
SplunkTrust

Another option to see list of search filters associated with users/roles is using REST APIs. This could be a starting point. List all the users, their corresponding roles and search filters.

| rest /services/authentication/users | table title, roles | mvexpand roles | join roles [| rest /services/authorization/roles | table title, srchFilter | rename title as roles] | stats values(roles) as roles, values(srchFilter) as SearchFilters by title