Reporting

Splunk Java SDK is not working based on splunk role/index defined for the user

angelinealex
Communicator

I am using Splunk Java SDK to fetch data from Splunk index.

I have the below in my splunk server.
User - Customer_1_User1
Role - customer1_role (which have access to only customer1_index)
Saved Search Name - test_savedsearch

I am connecting to splunk from the java application (using Splunk Java SDK) using below code snippet

    loginArgs.setUsername("Customer_1_User1"));             
    loginArgs.setPassword("xxxx"));                 
    loginArgs.setHost("splunkHostName"));                                   
    loginArgs.setPort(8059);
    Service splunkService = Service.connect(loginArgs)

    //Get the earliest and latest time
SavedSearchDispatchArgs savedSearchDispatchArgs = getEarliestAndLatestTime();

SavedSearchCollection savedSearches = splunkService.getSavedSearches();
SavedSearch savedSearch = splunkService.getSavedSearches().get("test_savedsearch");
Job jobSavedSearch = savedSearch.dispatch(savedSearchDispatchArgs);
Map<String, Object> arguments = new HashMap<String, Object>();
arguments.put("count", 0);
InputStream resultsNormalSearch = jobSavedSearch.getResults(arguments);
ResultsReaderXml resultsReaderNormalSearch = new ResultsReaderXml(resultsNormalSearch);

//fetch data from resultsReaderNormalSearch

When I am trying to fetch data from test_savedsearch through java its returning 500 records.

'customer1_index' has 150 records only. Its fetching 150 records properly when I run the saved search in splunk.

Why its fetching all data through java application irrespective of roles/index defined to the user??

Please help to resolve this issue.

0 Karma

xpac
SplunkTrust
SplunkTrust

Please add the lines of code where you actually start the search, fetch the results etc.

0 Karma

angelinealex
Communicator

updated my code. Please have a look.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...