Getting Data In

Rest API get users assigned to a role

ebythomaspanick
Explorer

Hi,

I'm trying to make a REST call to get the list of users assigned to a particular role. Is there any such call that can get me this information? I found
https://:8089/servicesNS/admin/UserRoleChecker/authentication/users which is more of a form
1User -> nRoles,
But I was looking for
1Role -> nUsers kind of a data.

Is there any such api call?

0 Karma

niketn
Legend

@ebythomaspanicker it is not 1 --> N it is N --> N so you can use the same REST API and pass specific role/s as per your need and display N User/s returned.

alt text

Try the following run anywhere dashboard examples which uses | rest /services/authorization/roles/ | fields title REST API to get the available Roles. Then on selection of Role/s it displays available roles.

<form>
  <label>Users Belonging to Particular Role</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <title>Select Roles and combination type to find Users belonging to the Roles</title>
      <input type="radio" token="tokConjuction" searchWhenChanged="true">
        <label>Combine Roles by</label>
        <choice value="AND">AND</choice>
        <choice value="OR">OR</choice>
        <default>AND</default>
        <change>
          <unset token="form.tokRoles"></unset>
        </change>
      </input>
      <input type="multiselect" token="tokRoles" searchWhenChanged="true">
        <label>Available Roles</label>
        <valuePrefix>roles=\"</valuePrefix>
        <valueSuffix>\"</valueSuffix>
        <delimiter> $tokConjuction$ </delimiter>
        <fieldForLabel>title</fieldForLabel>
        <fieldForValue>title</fieldForValue>
        <search>
          <query>| rest /services/authorization/roles/
| fields title</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </input>
      <table>
        <search>
          <query>| rest /services/authentication/users search="$tokRoles$"
| fields title
| rename title as "User/s (for selected Roles)"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Long before a new capability reaches the keynote stage, it begins as an idea waiting to be tested. At ...

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Why Universal Forwarders Should Not Be Used as Intermediate Forwarders A practical Splunk forwarding topology ...

Data Management Digest – August 2026

Data Management Digest   Welcome to the August 2026 edition of Data Management Digest! August was a big month ...