Reporting

Splunk Java SDK is not working based on splunk role/index defined for the user

angelinealex
Communicator

I am using Splunk Java SDK to fetch data from Splunk index.

I have the below in my splunk server.
User - Customer_1_User1
Role - customer1_role (which have access to only customer1_index)
Saved Search Name - test_savedsearch

I am connecting to splunk from the java application (using Splunk Java SDK) using below code snippet

    loginArgs.setUsername("Customer_1_User1"));             
    loginArgs.setPassword("xxxx"));                 
    loginArgs.setHost("splunkHostName"));                                   
    loginArgs.setPort(8059);
    Service splunkService = Service.connect(loginArgs)

    //Get the earliest and latest time
SavedSearchDispatchArgs savedSearchDispatchArgs = getEarliestAndLatestTime();

SavedSearchCollection savedSearches = splunkService.getSavedSearches();
SavedSearch savedSearch = splunkService.getSavedSearches().get("test_savedsearch");
Job jobSavedSearch = savedSearch.dispatch(savedSearchDispatchArgs);
Map<String, Object> arguments = new HashMap<String, Object>();
arguments.put("count", 0);
InputStream resultsNormalSearch = jobSavedSearch.getResults(arguments);
ResultsReaderXml resultsReaderNormalSearch = new ResultsReaderXml(resultsNormalSearch);

//fetch data from resultsReaderNormalSearch

When I am trying to fetch data from test_savedsearch through java its returning 500 records.

'customer1_index' has 150 records only. Its fetching 150 records properly when I run the saved search in splunk.

Why its fetching all data through java application irrespective of roles/index defined to the user??

Please help to resolve this issue.

0 Karma

xpac
SplunkTrust
SplunkTrust

Please add the lines of code where you actually start the search, fetch the results etc.

0 Karma

angelinealex
Communicator

updated my code. Please have a look.

0 Karma
Get Updates on the Splunk Community!

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...

Community Content Calendar, August edition

In the dynamic world of cybersecurity, staying ahead means constantly solving new puzzles and optimizing your ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...