Hello Splunkers!
Does anyone have some SPL for a report that will show me ALL attributes that are assigned to each role? I'm trying to assess which of the roles listed in our Splunk environment have the attribute "schedule_search" assigned to them. Thank you.
You've probably figured it out by now, but in case you haven't try this.
| rest /services/admin/users | where like(capabilities,"%schedule_search%") | table title roles capabilities
You've probably figured it out by now, but in case you haven't try this.
| rest /services/admin/users | where like(capabilities,"%schedule_search%") | table title roles capabilities
This is perfect, Rich. Thank you.