I have the below rest searches to fetch the User, Role and Application details, respectively.
However, am not able to define the exact read only capabilities for my role to assign, so I can run these searches to get the results.
Below are the capabilities I investigated:
However, am not getting the entire application list as compared to Admin role. Also the editroles and edituser are giving write permission and am looking for read permission only.
Can you elaborate a little here?
what is the problem you are trying to solve?
What is the outcome / search output you are anticipating?
I have a certain dashboard listing all Splunk users and what role-capabilities are assigned to them. For which I have used the above mentioned Rest API commands.
However the dashboard users are not able to see the results as they don't below capabilities.
edit_roles edit_user rest_properties_get search
If I assign these capabilities to them, then they can delete/update the user-role information from GUI settings, which I don't want.
Please check if the answer https://answers.splunk.com/answers/745460/rest-call-in-subsearch.html helps you
The original query is for indexes, but you can put the other REST endpoints change to see if it works.