Reporting

Splunk Java SDK is not working based on splunk role/index defined for the user

angelinealex
Communicator

I am using Splunk Java SDK to fetch data from Splunk index.

I have the below in my splunk server.
User - Customer_1_User1
Role - customer1_role (which have access to only customer1_index)
Saved Search Name - test_savedsearch

I am connecting to splunk from the java application (using Splunk Java SDK) using below code snippet

    loginArgs.setUsername("Customer_1_User1"));             
    loginArgs.setPassword("xxxx"));                 
    loginArgs.setHost("splunkHostName"));                                   
    loginArgs.setPort(8059);
    Service splunkService = Service.connect(loginArgs)

    //Get the earliest and latest time
SavedSearchDispatchArgs savedSearchDispatchArgs = getEarliestAndLatestTime();

SavedSearchCollection savedSearches = splunkService.getSavedSearches();
SavedSearch savedSearch = splunkService.getSavedSearches().get("test_savedsearch");
Job jobSavedSearch = savedSearch.dispatch(savedSearchDispatchArgs);
Map<String, Object> arguments = new HashMap<String, Object>();
arguments.put("count", 0);
InputStream resultsNormalSearch = jobSavedSearch.getResults(arguments);
ResultsReaderXml resultsReaderNormalSearch = new ResultsReaderXml(resultsNormalSearch);

//fetch data from resultsReaderNormalSearch

When I am trying to fetch data from test_savedsearch through java its returning 500 records.

'customer1_index' has 150 records only. Its fetching 150 records properly when I run the saved search in splunk.

Why its fetching all data through java application irrespective of roles/index defined to the user??

Please help to resolve this issue.

0 Karma

xpac
SplunkTrust
SplunkTrust

Please add the lines of code where you actually start the search, fetch the results etc.

0 Karma

angelinealex
Communicator

updated my code. Please have a look.

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...