Getting Data In

Rest API get users assigned to a role

ebythomaspanick
Explorer

Hi,

I'm trying to make a REST call to get the list of users assigned to a particular role. Is there any such call that can get me this information? I found
https://:8089/servicesNS/admin/UserRoleChecker/authentication/users which is more of a form
1User -> nRoles,
But I was looking for
1Role -> nUsers kind of a data.

Is there any such api call?

0 Karma

niketn
Legend

@ebythomaspanicker it is not 1 --> N it is N --> N so you can use the same REST API and pass specific role/s as per your need and display N User/s returned.

alt text

Try the following run anywhere dashboard examples which uses | rest /services/authorization/roles/ | fields title REST API to get the available Roles. Then on selection of Role/s it displays available roles.

<form>
  <label>Users Belonging to Particular Role</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <title>Select Roles and combination type to find Users belonging to the Roles</title>
      <input type="radio" token="tokConjuction" searchWhenChanged="true">
        <label>Combine Roles by</label>
        <choice value="AND">AND</choice>
        <choice value="OR">OR</choice>
        <default>AND</default>
        <change>
          <unset token="form.tokRoles"></unset>
        </change>
      </input>
      <input type="multiselect" token="tokRoles" searchWhenChanged="true">
        <label>Available Roles</label>
        <valuePrefix>roles=\"</valuePrefix>
        <valueSuffix>\"</valueSuffix>
        <delimiter> $tokConjuction$ </delimiter>
        <fieldForLabel>title</fieldForLabel>
        <fieldForValue>title</fieldForValue>
        <search>
          <query>| rest /services/authorization/roles/
| fields title</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </input>
      <table>
        <search>
          <query>| rest /services/authentication/users search="$tokRoles$"
| fields title
| rename title as "User/s (for selected Roles)"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Splunk Developer Day announcements: AI agents, MCP tools, Forecasting, and Custom ...

Splunk Developer Day was packed with product and platform updates for developers building in the AI ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...