Audit of Spunk Roles and the Attributes Assigned to them

[itsmevic]

Hello Splunkers! 

    Does anyone have some SPL for a report that will show me ALL attributes that are assigned to each role?   I'm trying to assess which of the roles listed in our Splunk environment have the attribute "schedule_search" assigned to them.    Thank you.

[richgalloway · Accepted solution]

You've probably figured it out by now, but in case you haven't try this.

| rest /services/admin/users | where like(capabilities,"%schedule_search%") | table title roles capabilities

[itsmevic]

This is perfect, Rich.  Thank you.