Is there a flat file where Splunk user names and assigned roles stored?

[jrdba]

Hi folks, I was wondering if there was a flat file that exists where user account names & their assigned roles are stored? I'm not trying to get passwords, just user names and assigned roles which we manually create. I'm trying to automate this process via powershell. Manual process is taking too long. Thank you much 🙂

Access control | Users | New button

[vasanthmss · Accepted solution]

Hi,

Below Search will help you to get the list of users, and you can write it in to csv / flat file.

|rest /services/authentication/users splunk_server=local |fields title roles realname email|rename title as userName|rename realname as Name | table Name, userName, email, roles | stats values(*) as * by userName delim=", " | nomv roles

You can use the command line / REST to create user. Either way you can do the same thing in your script,

Read this Doc

 1. Write a script to search list of users and their roles (the above search query) and output your results to CSV/flat file. So you can access the csv/flat file from your script.
 2. using REST / Command line user insert you can create n number of users.

Cheers!

[jrdba]

When i try to run a CLI command to add a dummy user account i get an error about non existent role. I can see the role exists in the admin web page under the "roles" column....

Ran command like this...

d:_programfiles_splunk_bin> .\splunk.exe add user michael -password changeme -role app-test -auth admin:[our password]

"In handler 'users' : Error creating user. role="app-test" does not exist"

Why would this be happening? Thanks for assistance

[jrdba]

I just realized basically run this search on the GUI. Thanks