I want to create a report or a dashboard to show roles and what indexes they have access to. Is there a way to do so from the internal logs?
you can use a REST call (if you have permission to do so) to get the information you are after, try this :
| rest /services/authorization/roles splunk_server=local
| table title imported_roles srchIndexesDefault imported_srchIndexesDefault
You can find more information about the REST API in Splunk here http://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing
Hope this helps ...
View solution in original post