Security

How to find user roles that have access to serachindexallowed * or _*

sajeshpp
Path Finder

I need to find the user roles which has searchindexallowed = " * or _* "
The below command list all the roles with searchindexallowed details, but how do I get only roles which has permission to all indexes.
| rest /services/admin/roles | table title, srchIndexesAllowed | rename title as role.

Also, is there any way to find this with btool command ?

0 Karma

hardikJsheth
Motivator

You have the correct query, just add search filter as follows:

| rest /services/admin/roles | search srchIndexesAllowed=* OR srchIndexesAllowed=_* |table title, srchIndexesAllowed | rename title as role
0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...