Knowledge Management

How to know the user role in splunk

pradjswl
Explorer

How can I know if I am just a normal user or Power user of the splunk i am using in my department without asking in perticular to admin. Is there a command or link which can identify my role in the splunk I am using.

Tags (1)
1 Solution

somesoni2
Revered Legend

Try running this query

| rest /services/authentication/current-context splunk_server=local | table title roles

View solution in original post

jkat54
SplunkTrust
SplunkTrust
 |rest /services/authentication/current-context has a roles column.

pradjswl
Explorer

Thank you @Jkat54. It returned a long list of rows/column. I believe it was very detailed information about my role.
| rest /services/authentication/current-context splunk_server=local | table title roles
was easiest way to read.

0 Karma

jkat54
SplunkTrust
SplunkTrust

ha ha ha! look at the response!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi pradjswl,
Try | rest /services/authorization/roles if you're enabled.
Bye.
Giuseppe

0 Karma

pradjswl
Explorer

Thank you @cusello. It returned a long list of rows/column. I believe it was very detailed information about my role.
| rest /services/authentication/current-context splunk_server=local | table title roles
was easiest way to read.

0 Karma

somesoni2
Revered Legend

Try running this query

| rest /services/authentication/current-context splunk_server=local | table title roles

pradjswl
Explorer

ty @somesoni2 I got a record with 5roles, and user is one of them. Rest 4 roles appears more or less like the app name I use in my project. So I believe I am user role and not Power user. Please correct me if I am wrong.

0 Karma

somesoni2
Revered Legend

Every role has certain capabilities. I can't say for certain that you're not power user. You've 4 other custom roles assigned to you and they may or may not have capabilities of power user. So easier option for you will be to check if you can change the sharing permission of any Splunk report/saved search or not. A regular user can't do that.

 user: this role can create and edit its own saved searches, run searches, edit its own preferences, create and edit event types, and other similar tasks.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...