Security
Highlighted

How can I display the current users metric index and their access permissions?

Path Finder

Hi,

We created a new app, which is configured as the default app for most of the users.
The app contains a default view, which lists all splunk indexes including the metric indexes.

For each index, there is a column which indicates, if the current user has access permissions for the corresponding index.
Our method to list all indexes with access permissions for the current user is:
| eventcount summarize=false index=*

However, this method doesn't work for the new indextype metric.

How can I list all the indexes, which the currently logged in user has access to?
The list should include the indexes searched by default and also the indexes which must be specified explicitly.

Thanks!
- Lorenz

0 Karma
Highlighted

Re: How can I display the current users metric index and their access permissions?

Contributor

I don't get it, with the above, all you do is counting every index that 'summarize' is false?

What I would do is something like:

index=* | dedup index | table index

Can you give other example or something?

What is the name of that column?

0 Karma
Highlighted

Re: How can I display the current users metric index and their access permissions?

Path Finder

In the world of event indexes, your example with
index=* | dedup index | table index
will work. It is just ways slower than my solution above.

With the new metric indexes in Splunk 7.x, i don't know how to archive the same result.
So again my question:
How can I list all metric indexes, which the currently logged in user has access to?

0 Karma
Highlighted

Re: How can I display the current users metric index and their access permissions?

New Member

Try this "| eventcount summarize=false index=* | dedup index | fields index"

0 Karma
Highlighted

Re: How can I display the current users metric index and their access permissions?

Path Finder

This doesn't show any metric indexes.

0 Karma
Highlighted

Re: How can I display the current users metric index and their access permissions?

Builder

Hello,

In case of metrics this does what you want:
| mstats count(value) where index=someMetricsIndex AND metricname=*

View solution in original post

0 Karma
Highlighted

Re: How can I display the current users metric index and their access permissions?

Path Finder

Hi,

your SPL-Statement will show all the metrics in one index.

What i want:
- List all metric indexes which exists
- List all metric indexes which the currently logged in user has access to

0 Karma
Highlighted

Re: How can I display the current users metric index and their access permissions?

Builder

OK. And what about this?

| mstats count(value) where index=* AND metricname=* by index

Highlighted

Re: How can I display the current users metric index and their access permissions?

Path Finder

This is working as expected.
Thanks!

0 Karma