Reporting

Audit of Spunk Roles and the Attributes Assigned to them

itsmevic
Communicator

Hello Splunkers! 

    Does anyone have some SPL for a report that will show me ALL attributes that are assigned to each role?   I'm trying to assess which of the roles listed in our Splunk environment have the attribute "schedule_search" assigned to them.    Thank you.

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You've probably figured it out by now, but in case you haven't try this.

| rest /services/admin/users | where like(capabilities,"%schedule_search%") | table title roles capabilities
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You've probably figured it out by now, but in case you haven't try this.

| rest /services/admin/users | where like(capabilities,"%schedule_search%") | table title roles capabilities
---
If this reply helps you, an upvote would be appreciated.

itsmevic
Communicator

This is perfect, Rich.  Thank you.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...